Chapter 10. Deploying the same SELinux configuration on multiple systems

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Managing SELinux
     hosts: managed-node-01.example.com
     tasks:
       - name: Restore SELinux context
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.selinux
         vars:
           selinux_restore_dirs:
             - /var/www/
             - /etc/

   The settings specified in the example playbook include the following:

   selinux_restore_dirs: <list>

   Defines the list of directories on which the role should reset the SELinux context.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.selinux/README.md file on the control node.

2. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Managing SELinux
     hosts: managed-node-01.example.com
     tasks:
       - name: Set http_port_t label on network port
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.selinux
         vars:
           selinux_ports:
             - ports: <port_number>
               proto: tcp
               setype: http_port_t
               state: present

   The settings specified in the example playbook include the following:

   ports: <port_number>

   Defines the port numbers to which you want to assign the SELinux label. Separate multiple values by comma.

   setype: <type_label>

   Defines the SELinux type label.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.selinux/README.md file on the control node.

2. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Managing SELinux
     hosts: managed-node-01.example.com
     tasks:
       - name: Deploying a SELinux module
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.selinux
         vars:
           selinux_modules:
             - path: <module_file>
   	    priority: <value>
               state: enabled

   The settings specified in the example playbook include the following:

   path: <module_file>

   Sets the path to the module file on the control node.

   priority: <value>

   Sets the SELinux module priority. 400 is the default.

   state: <value>

   Defines the state of the module:

   • enabled: Install or enable the module.
   • disabled: Disable a module.
   • absent: Remove a module.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.selinux/README.md file on the control node.

2. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook ~/playbook.yml

Procedure

1. Log in to the RHEL 8 web console.

   For details, see Logging in to the web console.

2. Click SELinux.

3. Click View the automation script.

   A window with the generated script opens. You can navigate between a shell script and an Ansible playbook generation options tab.

   

4. Click the Copy to clipboard button to select the script or playbook and apply it.

Procedure

1. Export your verified SELinux settings:

   Copy to Clipboard Toggle word wrap

   # semanage export -f ./my-selinux-settings.mod

2. Copy the file with the settings to the new system:

   Copy to Clipboard Toggle word wrap

   # scp ./my-selinux-settings.mod new-system-hostname:

3. Log in on the new system:

   Copy to Clipboard Toggle word wrap

   $ ssh root@new-system-hostname

4. Import the settings on the new system:

   Copy to Clipboard Toggle word wrap

   new-system-hostname# semanage import -f ./my-selinux-settings.mod