FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Redhat > Fedora SELinux Support

 
 
LinkBack Thread Tools
 
Old 09-21-2011, 09:47 PM
Erinn Looney-Triggs
 
Default Best way to copy local changes between hosts

I am using puppet to manage my system configuration and I am looking for
the best way to manage file context changes between multiple hosts.

Basically I have some local changes that are held in
/etc/selinux/targeted/modules/active/file_contexts.local, is it
reasonable just to copy this file to hosts that need to be aware of the
changes held therein or is there a better method?

This would be implemented on RHEL 5 and 6 systems.

Thanks,
-Erinn

--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
 
Old 09-22-2011, 07:00 AM
Dominick Grift
 
Default Best way to copy local changes between hosts

On Wed, 2011-09-21 at 13:47 -0800, Erinn Looney-Triggs wrote:
> I am using puppet to manage my system configuration and I am looking for
> the best way to manage file context changes between multiple hosts.
>
> Basically I have some local changes that are held in
> /etc/selinux/targeted/modules/active/file_contexts.local, is it
> reasonable just to copy this file to hosts that need to be aware of the
> changes held therein or is there a better method?
>
> This would be implemented on RHEL 5 and 6 systems.

I guess the following might be the preferred way:

> Managing multiple machines
> Multiple machines that need the same customizations.
> Extract customizations off first machine, copy them
> to second and import them.
>
> # semanage -o /tmp/local.selinux
> # scp /tmp/local.selinux secondmachine:/tmp
> # ssh secondmachine
> # semanage -i /tmp/local.selinux
>
> If these customizations include file context, you need to apply the
> context using restorecon.

From: "man semanage"

> Thanks,
> -Erinn
>
> --
> selinux mailing list
> selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux

--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
 
Old 09-22-2011, 12:50 PM
Daniel J Walsh
 
Default Best way to copy local changes between hosts

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/21/2011 05:47 PM, Erinn Looney-Triggs wrote:
> I am using puppet to manage my system configuration and I am
> looking for the best way to manage file context changes between
> multiple hosts.
>
> Basically I have some local changes that are held in
> /etc/selinux/targeted/modules/active/file_contexts.local, is it
> reasonable just to copy this file to hosts that need to be aware of
> the changes held therein or is there a better method?
>
> This would be implemented on RHEL 5 and 6 systems.
>
> Thanks, -Erinn
>
> -- selinux mailing list selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux

/etc/selinux/targeted/modules/active/file_contexts.local
# This file is only used when policy is updated
and
/etc/selinux/targeted/contexts/files/file_contexts.local
# This file is actually the one used by restorecon and rpm ...

Should be kept in sync, and would work on RHEL5 and RHEL6,

You could also use the method Dominick described for distributing all
local canonizations.

You might want to write puppet script that would dump local
customizations and check it versus global customizations, and apply
the global if they differ, since semanage -i will take a long time to run.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk57LxQACgkQrlYvE4MpobNtdQCgzoik2f4hNo ++/pxWRVuxWfrK
P9QAoL4Gtks4ZfqY7hApKCmL2C6HNqnH
=6FSf
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
 
Old 09-22-2011, 01:01 PM
Adam Przybyla
 
Default Best way to copy local changes between hosts

On Wed, Sep 21, 2011 at 01:47:32PM -0800, Erinn Looney-Triggs wrote:
> I am using puppet to manage my system configuration and I am looking for
> the best way to manage file context changes between multiple hosts.
>
> Basically I have some local changes that are held in
> /etc/selinux/targeted/modules/active/file_contexts.local, is it
> reasonable just to copy this file to hosts that need to be aware of the
> changes held therein or is there a better method?
>
> This would be implemented on RHEL 5 and 6 systems.
... try csync2:
http://thuannvn.blogspot.com/2010/01/csync2-is-so-cool.html
Regards
Adam Przybyla
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
 
Old 09-22-2011, 01:23 PM
Daniel J Walsh
 
Default Best way to copy local changes between hosts

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/22/2011 09:01 AM, Adam Przybyla wrote:
> On Wed, Sep 21, 2011 at 01:47:32PM -0800, Erinn Looney-Triggs
> wrote:
>> I am using puppet to manage my system configuration and I am
>> looking for the best way to manage file context changes between
>> multiple hosts.
>>
>> Basically I have some local changes that are held in
>> /etc/selinux/targeted/modules/active/file_contexts.local, is it
>> reasonable just to copy this file to hosts that need to be aware
>> of the changes held therein or is there a better method?
>>
>> This would be implemented on RHEL 5 and 6 systems.
> ... try csync2:
> http://thuannvn.blogspot.com/2010/01/csync2-is-so-cool.html
> Regards Adam Przybyla -- selinux mailing list
> selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
Also make sure any tool that you use, insures the label on files
(restorecon) after putting them in place. Having the tool understand
SELinux and telling the kernel to label the file before it is created
is even better.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk57NucACgkQrlYvE4MpobPWNwCdEm0gYKYrlO 0VFHUh7MQ2PsvQ
cAsAoNaB7cYYWqKXFUYzH/mstB+iAr6P
=dsLd
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
 
Old 09-22-2011, 01:24 PM
Daniel J Walsh
 
Default Best way to copy local changes between hosts

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 09/22/2011 09:01 AM, Adam Przybyla wrote:
> On Wed, Sep 21, 2011 at 01:47:32PM -0800, Erinn Looney-Triggs
> wrote:
>> I am using puppet to manage my system configuration and I am
>> looking for the best way to manage file context changes between
>> multiple hosts.
>>
>> Basically I have some local changes that are held in
>> /etc/selinux/targeted/modules/active/file_contexts.local, is it
>> reasonable just to copy this file to hosts that need to be aware
>> of the changes held therein or is there a better method?
>>
>> This would be implemented on RHEL 5 and 6 systems.
> ... try csync2:
> http://thuannvn.blogspot.com/2010/01/csync2-is-so-cool.html
> Regards Adam Przybyla -- selinux mailing list
> selinux@lists.fedoraproject.org
> https://admin.fedoraproject.org/mailman/listinfo/selinux
Does csync2 support extended attributes?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk57NyIACgkQrlYvE4MpobM24gCfefbF0ktbbi jcXvZrpeHRVsJe
SPcAn3QBbXJxRr37A3ZXQqA0wUAudSDc
=fYfv
-----END PGP SIGNATURE-----
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
 
Old 09-22-2011, 03:57 PM
Adam Przybyla
 
Default Best way to copy local changes between hosts

On Thu, Sep 22, 2011 at 09:24:50AM -0400, Daniel J Walsh wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 09/22/2011 09:01 AM, Adam Przybyla wrote:
> > On Wed, Sep 21, 2011 at 01:47:32PM -0800, Erinn Looney-Triggs
> > wrote:
> >> I am using puppet to manage my system configuration and I am
> >> looking for the best way to manage file context changes between
> >> multiple hosts.
> >>
> >> Basically I have some local changes that are held in
> >> /etc/selinux/targeted/modules/active/file_contexts.local, is it
> >> reasonable just to copy this file to hosts that need to be aware
> >> of the changes held therein or is there a better method?
> >>
> >> This would be implemented on RHEL 5 and 6 systems.
> > ... try csync2:
> > http://thuannvn.blogspot.com/2010/01/csync2-is-so-cool.html
> > Regards Adam Przybyla -- selinux mailing list
> > selinux@lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> Does csync2 support extended attributes?
... nope, but you could execeute some commands on remote systems
after file was send. Use "exec" statement in your configs. Regards
Adam Przybyla
--
selinux mailing list
selinux@lists.fedoraproject.org
https://admin.fedoraproject.org/mailman/listinfo/selinux
 

Thread Tools




All times are GMT. The time now is 08:31 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org