blob: 9a6bbaefd52831f812fc178a3c0c6da797045ac4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
.. -*- mode: rst -*-
.. _server-plugins-generators-semodules:
=========
SEModules
=========
.. versionadded:: 1.3.0
The SEModules plugin handles SELinux module entries. It supports
group- and host-specific module versions, and enabling/disabling
modules.
You can use ``selinux_baseline.py`` located in the tools/ directory to
create a baseline of all of your installed modules.
See :ref:`server-selinux` for more information.
Usage
=====
To use the SEModules plugin, first do ``mkdir
/var/lib/bcfg2/SEModules``. Add ``SEModules`` to your ``plugins``
line in ``/etc/bcfg2.conf`` and restart bcfg2-server.
The SEModules directory contains modules in a layout similar to the
Cfg plugin: at the top level, SEModules should contain directories
named after the modules you want to install, and each of those
directories can contain a global module, plus any number of group- and
host-specific modules. For instance::
$ ls -F SEModules
foo.pp/ bar.pp/
$ ls SEModules/foo.pp/
foo.pp
foo.pp.G50_server
foo.pp.H_baz.example.com
For more information on this directory layout, see
:ref:`server-plugins-generators-cfg`.
Entries
=======
SEModules handles ``<SELinux>`` entries with the ``module`` type. For
instance:
.. code-block:: xml
<Bundle name="foo">
<SELinux type="module" name="foo.pp"/>
</Bundle>
The ``.pp`` extension is optional.
.. note::
If you use a ``BoundSELinux`` tag, you must *not* include the
``.pp`` extension. This is not recommend, though.
You can also install a disabled module:
.. code-block:: xml
<SELinux type="module" name="foo" disabled="true"/>
|
