Chapter 10. Deploying the same SELinux configuration on multiple systems

• Cleaning local policy modifications related to SELinux booleans, file contexts, ports, and logins.
• Setting SELinux policy booleans, file contexts, ports, and logins.
• Restoring file contexts on specified files or directories.
• Managing SELinux modules.

Prerequisites

• You have prepared the control node and the managed nodes
• You are logged in to the control node as a user who can run playbooks on the managed nodes.
• The account you use to connect to the managed nodes has sudo permissions on them.

Prerequisites

• You have prepared the control node and the managed nodes
• You are logged in to the control node as a user who can run playbooks on the managed nodes.
• The account you use to connect to the managed nodes has sudo permissions on them.
• Optional: To verify port status by using the semanage command, the policycoreutils-python-utils package must be installed.

Procedure

• To configure just the port number without making other changes, use the seport module:

  - name: Allow Apache to listen on tcp port <port_number>
    community.general.seport:
      ports: <port_number>
      proto: tcp
      setype: http_port_t
      state: present

  Replace <port_number> with the port number to which you want to assign the http_port_t type.

• For more complex configuration of the managed nodes that involves other customizations of SELinux, use the selinux RHEL system role. Create a playbook file, for example, ~/playbook.yml, and add the following content:

  ---
  - name: Modify SELinux port mapping example
    hosts: all
    vars:
      # Map tcp port <port_number> to the 'http_port_t' SELinux port type
      selinux_ports:
        - ports: <port_number>
          proto: tcp
          setype: http_port_t
          state: present
  
    tasks:
      - name: Include selinux role
        ansible.builtin.include_role:
          name: rhel-system-roles.selinux

  Replace <port_number> with the port number to which you want to assign the http_port_t type.

Verification

• Verify that the port is assigned to the http_port_t type:

  # semanage port --list | grep http_port_t
  http_port_t                	tcp  	<port_number>, 80, 81, 443, 488, 8008, 8009, 8443, 9000

Prerequisites

• You have installed the RHEL 9 web console.

  For instructions, see Installing and enabling the web console.

Prerequisites

• The policycoreutils-python-utils package is installed on your system.