selinux
Manage SELinux security contexts on files and directories. Linux only.
Parameters
| Parameter | Required | Description |
|---|---|---|
path |
Yes | File or directory path to manage |
context |
No | Full SELinux context (e.g., system_u:object_r:httpd_sys_content_t:s0) |
selinux_type |
No | SELinux type component only (e.g., httpd_sys_content_t) -- shorthand |
state |
Yes | -- |
Either context or selinux_type must be specified.
Behavior
Check: Runs ls -Z <path> to get the current SELinux context. Compares with the desired context.
Apply (full context): chcon <context> <path>
Apply (selinux_type only, persistent):
semanage fcontext -a -t <selinux_type> <path>(or-mto modify existing)restorecon -v <path>
Remove (state: absent):
semanage fcontext -d <path>restorecon -v <path>
Examples
Set context on a web content directory
- name: web-content-context
type: selinux
path: /var/www/html
selinux_type: httpd_sys_content_t
Set a full context
- name: custom-context
type: selinux
path: /opt/app/data
context: "system_u:object_r:usr_t:s0"
SELinux context on file resources
The file executor also supports a secontext parameter to set the SELinux context after writing a file:
- name: app-config
type: file
target_path: /etc/app/config.yml
content: "..."
secontext: "system_u:object_r:etc_t:s0"