Project: Chef InSpec (Provisioning / Security & Compliance)
File: selinux.md

+++ title = "selinux resource" draft = false gh_repo = "inspec" platform = "linux" [menu] [menu.inspec] title = "selinux" identifier = "inspec/resources/os/selinux.md selinux resource" parent = "inspec/resources/os" +++ Use the `selinux` Chef InSpec audit resource to test the configuration data of the SELinux policy, SELinux modules and SELinux booleans. The `selinux` resource extracts and exposes data reported by the `sestatus`, `semodule -lfull`, and `semanage boolean -l -n` command. {{< readfile file="content/inspec/reusable/md/inspec_installation.md" >}} This resource first became available in v4.35.1 of InSpec. The `selinux` Chef InSpec resource block tests the state and mode of SELinux policy. describe selinux do it { should be_installed } it { shouldnot bedisabled } it { should be_enforcing } it { shouldnot bepermissive } end The `selinux` resource block also allows you to write tests for multiple modules: describe selinux.modules.where("zebra") do it { should exist } it { should be_installed } it { should be_enabled } end or: describe selinux.modules.where(status: "installed") do it { should exist } its('count') { should cmp 404 } end where: `.where()` specifies the parameter and expected value. `name`, `status`, `state`, and `priority` are valid parameters. The `selinux` resource block also allows you to write tests for multiple booleans: describe selinux.booleans.where(name: "httpdenablehomedirs") do it { shouldnot beon } end or: describe selinux.booleans.where(name: "xendrunblktap", state: "on") do it { should exist } its('defaults') { should cmp "on" } end `.where()` specifies the parameter and expected value. `name`, `state`, and `default` are valid parameters for `booleans`. The following examples show how to use this Chef InSpec selinux resource. describe selinux do it { should be_installed } it { shouldnot bedisabled } end describe selinux do it { shouldnot bedisabled } it { should be_enforcing } end describe selinux do its('policy') { should eq "targeted"} end {{< readfile file="content/inspec/reusable/md/inspecmatcherslink.md" >}} This resource has the following special matchers. The `be_installed` matcher tests if the SElinux policy or SElinux modules are installed on the system: it { should be_installed } The `be_disabled` matcher tests if the SELinux is disabled on the system: it { should be_disabled } The `be_enforcing` matcher tests if the SELinux mode is set to enforcing: it { should be_enforcing } The `be_permissive` matcher tests if the SELinux mode is set to permissive: it { should be_permissive } The `be_on` matcher tests if the SELinux boolean is on: it { should be_on } The `be_enabled` matcher tests if the SElinux module is enabled: it { should be_enabled } `names`, `status`, `states`, and `priorities` are valid parameters for SELinux policy modules. `names`, `status`, `states`, and `defaults` are valid parameters for SELinux `booleans`. `modules` returns information about SELinux modules using the command. Note: The `semodule -l` command for newer versions of Linux-based systems like RHEL8 and Centos8, so we do not support that option. ```ruby describe selinux.modules do its("names") { should include "zebra" } its("status") { should include "installed" } its("states") { should include "enabled" } its("priorities") { should include "100" } end ``` `booleans` returns information about SELinux booleans using the command. ```ruby describe selinux.booleans do its("names") { should include "httpdenablehomedirs" } its("states") { should include "on" } its("states") { should include "off" } its("defaults") { should include "on" } its("defaults") { should include "off" } end ```