Chapter 24. Configuring SELinux by using RHEL system roles

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Managing SELinux
     hosts: managed-node-01.example.com
     tasks:
       - name: Restore SELinux context
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.selinux
         vars:
           selinux_restore_dirs:
             - /var/www/
             - /etc/

   The settings specified in the example playbook include the following:

   selinux_restore_dirs: <list>

   Defines the list of directories on which the role should reset the SELinux context.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.selinux/README.md file on the control node.

2. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Managing SELinux
     hosts: managed-node-01.example.com
     tasks:
       - name: Set http_port_t label on network port
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.selinux
         vars:
           selinux_ports:
             - ports: <port_number>
               proto: tcp
               setype: http_port_t
               state: present

   The settings specified in the example playbook include the following:

   ports: <port_number>

   Defines the port numbers to which you want to assign the SELinux label. Separate multiple values by comma.

   setype: <type_label>

   Defines the SELinux type label.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.selinux/README.md file on the control node.

2. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook ~/playbook.yml

Procedure

1. Create a playbook file, for example ~/playbook.yml, with the following content:

   Copy to Clipboard Toggle word wrap

   ---
   - name: Managing SELinux
     hosts: managed-node-01.example.com
     tasks:
       - name: Deploying a SELinux module
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.selinux
         vars:
           selinux_modules:
             - path: <module_file>
   	    priority: <value>
               state: enabled

   The settings specified in the example playbook include the following:

   path: <module_file>

   Sets the path to the module file on the control node.

   priority: <value>

   Sets the SELinux module priority. 400 is the default.

   state: <value>

   Defines the state of the module:

   • enabled: Install or enable the module.
   • disabled: Disable a module.
   • absent: Remove a module.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.selinux/README.md file on the control node.

2. Validate the playbook syntax:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook --syntax-check ~/playbook.yml

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   Copy to Clipboard Toggle word wrap

   $ ansible-playbook ~/playbook.yml