public
Created

selinux::fcontext puppet module that does not take ages to verify.

  • Download Gist
gistfile1.pp
Puppet
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33
define selinux::fcontext($ensure, $type, $path, $grep) {
# Add or remove a permanent SELinux local file context to the system
# Normally this is done in a specific SELinux module but the define can
# be used for one-offs.
 
case $ensure {
'present': {
exec { "semanage-fcontext-$title":
command => "/usr/sbin/semanage fcontext -a -t $type '$path'",
unless => "/bin/grep -q '^$grep' /etc/selinux/targeted/contexts/files/file_contexts.local",
 
#XXX: The command below is the canonical way to check for active persistant
# file contexts, but this takes ~5 seconds per run instead of the
# simple grep above because semanage fcontext -l takes a long time.
#unless => "/usr/sbin/semanage fcontext -l | /bin/grep -q '^$grep'",
}
}
'absent': {
exec { "semanage-fcontext-$title":
command => "/usr/sbin/semanage fcontext -d -t $type '$path'",
unless => "/bin/grep -q '^$grep' /etc/selinux/targeted/contexts/files/file_contexts.local",
 
#XXX: The command below is the canonical way to check for active persistant
# file contexts, but this takes ~5 seconds per run instead of the
# simple grep above because semanage fcontext -l takes a long time.
#unless => "/usr/sbin/semanage fcontext -l | /bin/grep -q '^$grep'",
}
}
default: {
error("unknown ensure value $ensure")
}
}
}

Please sign in to comment on this gist.

Something went wrong with that request. Please try again.