Operations grimoire/RHEL
From Nasqueron Agora
Docker engines servers uses CentOS Stream (e.g. Dwellers) or Rocky (e.g. docker-002).
SELinux
States targeting RHEL machines need to apply the relevant SELinux context to each directory and file.
For example, to apply the context httpd_log_t
to /var/log/www
:
{% set has_selinux = salt['grains.get']('selinux:enabled', False) %} /var/log/www: file.directory: - user: {{ options["www_user"] }} - group: web - dir_mode: 711 {% if has_selinux %} selinux_context_nginx_logs: selinux.fcontext_policy_present: - name: /var/log/www - sel_type: httpd_log_t selinux_context_nginx_logs_applied: selinux.fcontext_policy_applied: - name: /var/log/www {% endif %}
You'll find examples in rOPS: roles/paas-docker/containers/ files.
For booleans (sebool) or custom policies, you'll find examples in rOPS: roles/paas-docker/nginx/selinux.sls