Menu Close
Chapter 10. Deploying the same SELinux configuration on multiple systems
This section provides two recommended ways for deploying your verified SELinux configuration on multiple systems:
- Using RHEL System Roles and Ansible
-
Using
semanage
export and import commands in your scripts
10.1. Introduction to the SELinux System Role
RHEL System Roles is a collection of Ansible roles and modules that provide a consistent configuration interface to remotely manage multiple RHEL systems. The SELinux System Role enables the following actions:
- Cleaning local policy modifications related to SELinux booleans, file contexts, ports, and logins.
- Setting SELinux policy booleans, file contexts, ports, and logins.
- Restoring file contexts on specified files or directories.
- Managing SELinux modules.
The following table provides an overview of input variables available in the SELinux System Role.
Table 10.1. SELinux System Role variables
Role variable | Description | CLI alternative |
---|---|---|
selinux_policy | Chooses a policy protecting targeted processes or Multi Level Security protection. |
|
selinux_state | Switches SELinux modes. |
|
selinux_booleans | Enables and disables SELinux booleans. |
|
selinux_fcontexts | Adds or removes a SELinux file context mapping. |
|
selinux_restore_dirs | Restores SELinux labels in the file-system tree. |
|
selinux_ports | Sets SELinux labels on ports. |
|
selinux_logins | Sets users to SELinux user mapping. |
|
selinux_modules | Installs, enables, disables, or removes SELinux modules. |
|
The /usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml
example playbook installed by the rhel-system-roles
package demonstrates how to set the targeted policy in enforcing mode. The playbook also applies several local policy modifications and restores file contexts in the /tmp/test_dir/
directory.
For a detailed reference on SELinux role variables, install the rhel-system-roles
package, and see the README.md
or README.html
files in the /usr/share/doc/rhel-system-roles/selinux/
directory.
Additional resources
10.2. Using the SELinux System Role to apply SELinux settings on multiple systems
Follow the steps to prepare and apply an Ansible playbook with your verified SELinux settings.
Prerequisites
- Access and permissions to one or more managed nodes, which are systems you want to configure with the SELinux System Role.
Access and permissions to a control node, which is a system from which Red Hat Ansible Core configures other systems.
On the control node:
-
The
ansible-core
andrhel-system-roles
packages are installed. - An inventory file which lists the managed nodes.
-
The
RHEL 8.0-8.5 provided access to a separate Ansible repository that contains Ansible Engine 2.9 for automation based on Ansible. Ansible Engine contains command-line utilities such as ansible
, ansible-playbook
, connectors such as docker
and podman
, and many plugins and modules. For information on how to obtain and install Ansible Engine, see the How to download and install Red Hat Ansible Engine Knowledgebase article.
RHEL 8.6 and 9.0 have introduced Ansible Core (provided as the ansible-core
package), which contains the Ansible command-line utilities, commands, and a small set of built-in Ansible plugins. RHEL provides this package through the AppStream repository, and it has a limited scope of support. For more information, see the Scope of support for the Ansible Core package included in the RHEL 9 and RHEL 8.6 and later AppStream repositories Knowledgebase article.
- An inventory file which lists the managed nodes.
Procedure
Prepare your playbook. You can either start from the scratch or modify the example playbook installed as a part of the
rhel-system-roles
package:# cp /usr/share/doc/rhel-system-roles/selinux/example-selinux-playbook.yml my-selinux-playbook.yml # vi my-selinux-playbook.yml
Change the content of the playbook to fit your scenario. For example, the following part ensures that the system installs and enables the
selinux-local-1.pp
SELinux module:selinux_modules: - { path: "selinux-local-1.pp", priority: "400" }
- Save the changes, and exit the text editor.
Run your playbook on the host1, host2, and host3 systems:
# ansible-playbook -i host1,host2,host3 my-selinux-playbook.yml
Additional resources
-
For more information, install the
rhel-system-roles
package, and see the/usr/share/doc/rhel-system-roles/selinux/
and/usr/share/ansible/roles/rhel-system-roles.selinux/
directories.
10.3. Transferring SELinux settings to another system with semanage
Use the following steps for transferring your custom and verified SELinux settings between RHEL 9-based systems.
Prerequisites
-
The
policycoreutils-python-utils
package is installed on your system.
Procedure
Export your verified SELinux settings:
# semanage export -f ./my-selinux-settings.mod
Copy the file with the settings to the new system:
# scp ./my-selinux-settings.mod new-system-hostname:
Log in on the new system:
$ ssh root@new-system-hostname
Import the settings on the new system:
new-system-hostname# semanage import -f ./my-selinux-settings.mod
Additional resources
-
semanage-export(8)
andsemanage-import(8)
man pages