salt-projectselinux

How to enforce a state only if a minon has SELinux installed?


I have code that installs a custom selinux module. In my fleet of minions there's Fedora-based systems (with SELinux installed) and Debian-based ones (without SELinux ). On the latter the module/installing state should not be used and I am thus looking for a way of retrieving a neat answer to the question "is SELinux installed on this system?" (NOT "is SELinux enforcing on this system?") to use in a corresponding jinja2 if clause.

Attempts that have me despairing are:

Any hint on how to go about this is appreciated.


Solution

  • If selinux is installed, then a grain is available:

    {% if 'selinux' in grains %}
    
    # stuff that's only included if selinux is available
    
    {% endif %}
    

    You can also use that grain for minion targeting:

    base:
      'selinux:*':
        - match: grain
        - my_states.for_selinux_only
    

    In general, you can also check whether a module has been loaded:

    {% if 'selinux.getconfig' in salt %}
    

    Whether an executable is on the PATH:

    {% if 'sestatus' | which %}
    

    Whether a package is installed (which also works in an onlyif parameter):

    {% if salt['pkg.version']('libselinux') %}