3 changes: 3 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
*.swp
pkg/*
vendor/bundle
18 changes: 18 additions & 0 deletions .project
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="UTF-8"?>
<projectDescription>
<name>selinux</name>
<comment></comment>
<projects>
</projects>
<buildSpec>
<buildCommand>
<name>org.eclipse.xtext.ui.shared.xtextBuilder</name>
<arguments>
</arguments>
</buildCommand>
</buildSpec>
<natures>
<nature>com.puppetlabs.geppetto.pp.dsl.ui.puppetNature</nature>
<nature>org.eclipse.xtext.ui.shared.xtextNature</nature>
</natures>
</projectDescription>
21 changes: 21 additions & 0 deletions Gemfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
source 'https://rubygems.org'


group :rake, :test do
gem 'puppetlabs_spec_helper', '>=0.8.2', :require => false
gem 'puppet-blacksmith', :require => false
gem 'rspec-system-puppet', :require => false
end

group :rake do
gem 'rspec-puppet', '>=1.0.1'
gem 'rake', '>=0.9.2.2'
gem 'puppet-lint', '>=1.0.1'
gem 'rspec-system-serverspec', :require => false
end

if puppetversion = ENV['PUPPET_GEM_VERSION']
gem 'puppet', puppetversion, :require => false
else
gem 'puppet', :require => false
end
165 changes: 165 additions & 0 deletions Gemfile.lock
Original file line number Diff line number Diff line change
@@ -0,0 +1,165 @@
GEM
remote: https://rubygems.org/
specs:
CFPropertyList (2.3.0)
builder (3.2.2)
diff-lcs (1.2.5)
excon (0.43.0)
facter (1.7.6)
fission (0.5.0)
CFPropertyList (~> 2.2)
fog (1.26.0)
fog-atmos
fog-brightbox (~> 0.4)
fog-core (~> 1.27, >= 1.27.1)
fog-ecloud
fog-json
fog-profitbricks
fog-radosgw (>= 0.0.2)
fog-sakuracloud (>= 0.0.4)
fog-softlayer
fog-storm_on_demand
fog-terremark
fog-vmfusion
fog-voxel
fog-xml (~> 0.1.1)
ipaddress (~> 0.5)
nokogiri (~> 1.5, >= 1.5.11)
fog-atmos (0.1.0)
fog-core
fog-xml
fog-brightbox (0.7.1)
fog-core (~> 1.22)
fog-json
inflecto (~> 0.0.2)
fog-core (1.27.3)
builder
excon (~> 0.38)
formatador (~> 0.2)
mime-types
net-scp (~> 1.1)
net-ssh (>= 2.1.3)
fog-ecloud (0.0.2)
fog-core
fog-xml
fog-json (1.0.0)
multi_json (~> 1.0)
fog-profitbricks (0.0.1)
fog-core
fog-xml
nokogiri
fog-radosgw (0.0.3)
fog-core (>= 1.21.0)
fog-json
fog-xml (>= 0.0.1)
fog-sakuracloud (0.1.1)
fog-core
fog-json
fog-softlayer (0.3.27)
fog-core
fog-json
fog-storm_on_demand (0.1.0)
fog-core
fog-json
fog-terremark (0.0.3)
fog-core
fog-xml
fog-vmfusion (0.0.1)
fission
fog-core
fog-voxel (0.0.2)
fog-core
fog-xml
fog-xml (0.1.1)
fog-core
nokogiri (~> 1.5, >= 1.5.11)
formatador (0.2.5)
hiera (1.3.4)
json_pure
highline (1.6.21)
inflecto (0.0.2)
ipaddress (0.8.0)
json_pure (1.8.2)
kwalify (0.7.2)
metaclass (0.0.4)
mime-types (1.25.1)
mocha (1.1.0)
metaclass (~> 0.0.1)
multi_json (1.10.1)
net-scp (1.2.1)
net-ssh (>= 2.6.5)
net-ssh (2.9.2)
netrc (0.10.2)
nokogiri (1.5.11)
puppet (3.7.3)
facter (> 1.6, < 3)
hiera (~> 1.0)
json_pure
puppet-blacksmith (3.1.1)
puppet (>= 2.7.16)
rest-client
puppet-lint (1.1.0)
puppet-syntax (1.4.1)
rake
puppetlabs_spec_helper (0.8.2)
mocha
puppet-lint
puppet-syntax
rake
rspec
rspec-puppet
rake (10.4.2)
rbvmomi (1.8.2)
builder
nokogiri (>= 1.4.1)
trollop
rest-client (1.7.2)
mime-types (>= 1.16, < 3.0)
netrc (~> 0.7)
rspec (2.99.0)
rspec-core (~> 2.99.0)
rspec-expectations (~> 2.99.0)
rspec-mocks (~> 2.99.0)
rspec-core (2.99.2)
rspec-expectations (2.99.2)
diff-lcs (>= 1.1.3, < 2.0)
rspec-mocks (2.99.3)
rspec-puppet (1.0.1)
rspec
rspec-system (2.8.0)
fog (~> 1.18)
kwalify (~> 0.7.2)
mime-types (~> 1.16)
net-scp (~> 1.1)
net-ssh (~> 2.7)
nokogiri (~> 1.5.10)
rbvmomi (~> 1.6)
rspec (~> 2.14)
systemu (~> 2.5)
rspec-system-puppet (2.2.1)
rspec-system (~> 2.0)
rspec-system-serverspec (2.0.1)
rspec-system (~> 2.0)
serverspec (~> 0.0)
specinfra (~> 0.0)
serverspec (0.16.0)
highline
net-ssh
rspec (~> 2.13)
specinfra (>= 0.7.1)
specinfra (0.8.0)
systemu (2.6.4)
trollop (2.1.1)

PLATFORMS
ruby

DEPENDENCIES
puppet
puppet-blacksmith
puppet-lint (>= 1.0.1)
puppetlabs_spec_helper (>= 0.8.2)
rake (>= 0.9.2.2)
rspec-puppet (>= 1.0.1)
rspec-system-puppet
rspec-system-serverspec
65 changes: 53 additions & 12 deletions README.markdown
Original file line number Diff line number Diff line change
@@ -1,23 +1,64 @@
# SELinux Puppet Module
# selinux

James Fryman <james@frymanet.com>
#### Table of Contents

# Description
1. [Overview](#overview)
2. [Module Description - What the module does and why it is useful](#module-description)
4. [Usage - Configuration options and additional functionality](#usage)
5. [Reference - An under-the-hood peek at what the module is doing and how](#reference)
6. [Defined Types](#defined-types)
7. [Development - Guide for contributing to the module](#development)
8. [Authors](#authors)

## Overview

This class manages SELinux on RHEL based systems.

## Module Description

This module will configure SELinux and/or deploy SELinux based modules to running system.

Requires puppetlabs/stdlib
[https://github.com/puppetlabs/puppetlabs-stdlib]

## Usage

Parameters:

- $mode (enforced|permissive|disabled) - sets the operating state for SELinux.
* `$mode` (enforced|permissive|disabled) - sets the operating state for SELinux.

# Actions:
This module will configure SELinux and/or deploy SELinux based modules to running
system.
## Reference

# Requires:
- Class[stdlib]. This is Puppet Labs standard library to include additional methods for use within Puppet. [https://github.com/puppetlabs/puppetlabs-stdlib]
Basic usage:

# Sample Usage:
<pre>
```puppet
include selinux
</pre>
```

More advanced usage:

```puppet
class { selinux:
mode => 'enforcing'
}
```

Deploy a custom module:

```puppet
selinux::module { 'resnet-puppet':
ensure => 'present',
source => 'puppet:///modules/site_puppet/site-puppet.te',
}
```

## Defined Types
* `fcontext` - Define fcontext types and equals values
* `boolean` - Set seboolean values
* `port` - Set selinux port context policies


## Development

## Authors
James Fryman <james@fryman.io>
21 changes: 21 additions & 0 deletions Rakefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
require 'bundler'
Bundler.require(:rake)
require 'rake/clean'

CLEAN.include('spec/fixtures/', 'doc', 'pkg')
CLOBBER.include('.tmp', '.librarian')

require 'puppetlabs_spec_helper/rake_tasks'
require 'puppet_blacksmith/rake_tasks'
require 'rspec-system/rake_task'

task :default => [:clean, :spec]

PuppetLint.configuration.fail_on_warnings
PuppetLint.configuration.send('relative')
PuppetLint.configuration.send('disable_80chars')
PuppetLint.configuration.send('disable_class_inherits_from_params_class')
PuppetLint.configuration.send('disable_class_parameter_defaults')
PuppetLint.configuration.send('disable_documentation')
PuppetLint.configuration.send('disable_single_quote_string_with_variables')
PuppetLint.configuration.ignore_paths = ["spec/**/*.pp", "pkg/**/*.pp"]
8 changes: 8 additions & 0 deletions files/restorecond.conf
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
/etc/services
/etc/resolv.conf
/etc/samba/secrets.tdb
/etc/mtab
/var/run/utmp
/var/log/wtmp
/root/*
/root/.ssh/*
49 changes: 49 additions & 0 deletions manifests/boolean.pp
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
# Definition: selinux::boolean
#
# Description
# This class will set the state of an SELinux boolean.
# All pending values are written to the policy file on disk, so they will be persistant across reboots.
# Ensure that the manifest notifies a related service as a restart for that service may be required.
#
# Class created by GreenOgre<aggibson@cogeco.ca>
# Adds to puppet-selinux by jfryman
# https://github.com/jfryman/puppet-selinux
#
# Parameters:
# - $ensure: (on|off) - Sets the current state of a particular SELinux boolean
#
# Actions:
# Runs "setsebool" to set boolean state
#
# Requires:
# - SELinux
#
# Sample Usage:
#
# selinux::boolean{ 'named_write_master_zones':
# ensure => "on",
# }
#

define selinux::boolean (
$ensure = 'undef'
) {

Exec {
path => '/bin:/sbin:/usr/bin:/usr/sbin',
}

case $ensure {
on, true: {
exec { "setsebool -P '${name}' true":
unless => "getsebool '${name}' | awk '{ print \$3 }' | grep on",
}
}
off, false: {
exec { "setsebool -P '${name}' false":
unless => "getsebool '${name}' | awk '{ print \$3 }' | grep off",
}
}
default: { err ( "Unknown or undefined boolean state ${ensure}" ) }
}
}
Loading