{"id":15013970,"url":"https://github.com/voxpupuli/puppet-selinux","last_synced_at":"2025-12-11T21:47:55.553Z","repository":{"id":1873561,"uuid":"2798871","full_name":"voxpupuli/puppet-selinux","owner":"voxpupuli","description":"Puppet Module to manage SELinux on RHEL machines","archived":false,"fork":false,"pushed_at":"2025-10-17T15:02:40.000Z","size":919,"stargazers_count":49,"open_issues_count":19,"forks_count":147,"subscribers_count":45,"default_branch":"master","last_synced_at":"2025-11-09T23:41:21.402Z","etag":null,"topics":["amazon-puppet-module","centos-puppet-module","debian-puppet-module","fedora-puppet-module","hacktoberfest","linux-puppet-module","puppet","redhat-puppet-module"],"latest_commit_sha":null,"homepage":"https://forge.puppet.com/puppet/selinux","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/voxpupuli.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"open_collective":"vox-pupuli","github":"voxpupuli"}},"created_at":"2011-11-17T21:47:08.000Z","updated_at":"2025-10-17T15:02:42.000Z","dependencies_parsed_at":"2023-07-06T01:55:45.412Z","dependency_job_id":"adc39f2e-1a06-4186-9fae-133d149bc016","html_url":"https://github.com/voxpupuli/puppet-selinux","commit_stats":{"total_commits":489,"total_committers":90,"mean_commits":5.433333333333334,"dds":0.7607361963190185,"last_synced_commit":"6abedc6f75fbc1313fd2cc4c4fd93a643e0aacc9"},"previous_names":["jfryman/puppet-selinux"],"tags_count":37,"template":false,"template_full_name":null,"purl":"pkg:github/voxpupuli/puppet-selinux","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-selinux","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-selinux/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-selinux/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-selinux/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/voxpupuli","download_url":"https://codeload.github.com/voxpupuli/puppet-selinux/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/voxpupuli%2Fpuppet-selinux/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":27670683,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-12-11T02:00:11.302Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amazon-puppet-module","centos-puppet-module","debian-puppet-module","fedora-puppet-module","hacktoberfest","linux-puppet-module","puppet","redhat-puppet-module"],"created_at":"2024-09-24T19:45:00.802Z","updated_at":"2025-12-11T21:47:55.548Z","avatar_url":"https://github.com/voxpupuli.png","language":"Ruby","funding_links":["https://opencollective.com/vox-pupuli","https://github.com/sponsors/voxpupuli"],"categories":[],"sub_categories":[],"readme":"# SELinux module for Puppet\n\n[![License](https://img.shields.io/github/license/voxpupuli/puppet-selinux.svg)](https://github.com/voxpupuli/puppet-selinux/blob/master/LICENSE)\n[![Build Status](https://github.com/voxpupuli/puppet-selinux/actions/workflows/ci.yml/badge.svg)](https://github.com/voxpupuli/puppet-selinux/actions/workflows/ci.yml)\n[![Puppet Forge](https://img.shields.io/puppetforge/v/puppet/selinux.svg)](https://forge.puppetlabs.com/puppet/selinux)\n[![Puppet Forge - downloads](https://img.shields.io/puppetforge/dt/puppet/selinux.svg)](https://forge.puppetlabs.com/puppet/selinux)\n[![Puppet Forge - endorsement](https://img.shields.io/puppetforge/e/puppet/selinux.svg)](https://forge.puppetlabs.com/puppet/selinux)\n[![Puppet Forge - scores](https://img.shields.io/puppetforge/f/puppet/selinux.svg)](https://forge.puppetlabs.com/puppet/selinux)\n\n## Table of Contents\n\n1. [Overview](#overview)\n1. [Module Description - What the module does and why it is useful](#module-description)\n1. [Usage - Configuration options and additional functionality](#usage)\n1. [Reference - An under-the-hood peek at what the module is doing and how](#reference)\n1. [Defined Types](#defined-types)\n1. [Development - Guide for contributing to the module](#development)\n1. [Authors](#authors)\n\n## Overview\n\nThis class manages SELinux.\n\n## Requirements\n\n* See `metadata.json`\n\n## Module Description\n\nThis module will configure SELinux and/or deploy SELinux based modules to\nrunning system.\n\n## Get in touch\n\n* IRC: [#voxpupuli on irc.freenode.net](irc://irc.freenode.net/voxpupuli)\n  ([Freenode WebChat](http://webchat.freenode.net/?channels=%23voxpupuli))\n* Mailinglist: \u003cvoxpupuli@groups.io\u003e\n  ([groups.io Webinterface](https://groups.io/g/voxpupuli/topics))\n\n## Upgrading from puppet-selinux 0.8.x\n\n* Previously, module building always used the refpolicy framework. The default\n  module builder is now 'simple', which uses only checkmodule. Not all features are\n  supported with this builder.\n\n  To build modules using the refpolicy framework like previous versions did,\n  specify the  'refpolicy' builder either explicitly per module or globally\n  via the main class\n\n* The interfaces to the various helper manifests has been changed to be more in line\n  with Puppet file resource naming conventions.\n\n  You will need to update your manifests to use the new parameter names.\n\n* The selinux::restorecond manifest to manage the restorecond service no longer exists\n\n## Known problems / limitations\n\n* The `selinux_python_command` fact is now deprecated and will be removed in\n  version 4 of the module.\n* If SELinux is disabled and you want to switch to permissive or enforcing you\n  are required to reboot the system (limitation of SELinux). The module won't\n  do this for you.\n* If SELinux is disabled and the user wants enforcing mode, the module\n  will downgrade to permissive mode instead to avoid transitioning directly from\n  disabled to enforcing state after a reboot and potentially breaking the system.\n  The user will receive a warning when this happens,\n* If you add filecontexts with `semanage fcontext` (what `selinux::fcontext`\n  does) the order is important. If you add /my/folder before /my/folder/subfolder\n  only /my/folder will match (limitation of SELinux). There is no such limitation\n  to file-contexts defined in SELinux modules. (GH-121)\n* If you try to remove a built-in permissive type, the operation will appear to succeed\n  but will actually have no effect, making your puppet runs non-idempotent.\n* The `selinux_port` provider may misbehave if the title does not correspond to\n  the format it expects. Users should use the `selinux::port` define instead except\n  when purging resources\n* Defining port ranges that overlap with existing ranges is currently not\n  detected, and will\n  cause semanage to error when the resource is applied.\n* On Debian systems, the defined types fcontext, permissive, and port do not\n  work because of [PA-2985](https://tickets.puppetlabs.com/browse/PA-2985).\n\n## Usage\n\nGenerated puppet strings documentation with examples is available in the [REFERENCE.md](./REFERENCE.md)\n\nIt's also included in the docs/ folder as simple html pages.\n\n## Reference\n\n### Basic usage\n\n```puppet\ninclude selinux\n```\n\nThis will include the module and allow you to use the provided defined types,\nbut will not modify existing SELinux settings on the system.\n\n### More advanced usage\n\n```puppet\nclass { selinux:\n  mode =\u003e 'enforcing',\n  type =\u003e 'targeted',\n}\n```\n\nThis will include the module and manage the SELinux mode (possible values are\n`enforcing`, `permissive`, and `disabled`) and enforcement type (possible values\nare `targeted`, `minimum`, and `mls`).\n\n#### Note on SELinux mode changes\nChanging SELinux between `enforcing`/`permissive` and `disabled` requires a reboot to take effect.\n\nWhen transitioning from `disabled` to `enforcing`:\n1. The module sets SELinux to `permissive`, which requires a reboot to take effect.\n2. After the reboot, the module updates the configuration and running state to `enforcing`.\n\nWhen transitioning from `enforcing` to `disabled`:\n1. The module sets SELinux to `disabled`, which requires a reboot to take effect, and sets the running state to `permissive` until then.\n2. After the reboot, SELinux will be fully disabled.\n\n### Deploy a custom module using the refpolicy framework\n\n```puppet\nselinux::module { 'resnet-puppet':\n  ensure    =\u003e 'present',\n  source_te =\u003e 'puppet:///modules/site_puppet/site-puppet.te',\n  source_fc =\u003e 'puppet:///modules/site_puppet/site-puppet.fc',\n  source_if =\u003e 'puppet:///modules/site_puppet/site-puppet.if',\n  builder   =\u003e 'refpolicy'\n}\n```\n\n### Using pre-compiled policy packages\n\n```puppet\nselinux::module { 'resnet-puppet':\n  ensure    =\u003e 'present',\n  source_pp =\u003e 'puppet:///modules/site_puppet/site-puppet.pp',\n}\n```\n\nNote that pre-compiled policy packages may not work reliably\nacross all RHEL / CentOS releases. It's up to you as the user\nto test that your packages load properly.\n\n### Set a boolean value\n\n```puppet\nselinux::boolean { 'puppetagent_manage_all_files': }\n```\n\n## Defined Types\n\n* `boolean` - Set seboolean values\n* `fcontext` - Define fcontext types and equals values\n* `module` - Manage an SELinux module\n* `permissive` - Set a context to `permissive`.\n* `port` - Set selinux port context policies\n\n## Development\n\n### Things to remember\n\n* The SELinux tools behave odd when SELinux is disabled\n  * `semanage` requires `--noreload` while in disabled mode when\n      adding or changing something\n  * Only few `--list` operations work\n* run acceptance tests: `./test-acceptance-with-vagrant`\n\n### Facter facts\n\nThe fact values might be unexpected while in disabled mode. One could expect\nthe config\\_mode to be set, but only the boolean `enabled` is set.\n\nThe most important facts:\n\n| Fact | Mode: disabled | Mode: permissive | Mode: enforcing |\n|---|---|---|---|\n| `$facts['os']['selinux']['enabled']` | false | true | true |\n| `$facts['os']['selinux']['config_mode']` | undef | Value of SELINUX in /etc/selinux/config | Value of SELINUX in /etc/selinux/config |\n| `$facts['os']['selinux']['current_mode']` | undef | Value of `getenforce` downcased | Value of `getenforce` downcased |\n\n## Authors\n\n* VoxPupuli \u003cvoxpupuli@groups.io\u003e\n* James Fryman \u003cjames@fryman.io\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-selinux","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fvoxpupuli%2Fpuppet-selinux","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fvoxpupuli%2Fpuppet-selinux/lists"}