Skip to content

CentOS SELinux fixes (ptpvsock, ptp4l) and hardening profile fix #836

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
matosatti wants to merge 3 commits into
base: main
Choose a base branch
from
Open

CentOS SELinux fixes (ptpvsock, ptp4l) and hardening profile fix #836

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5a1bec9
Fix ssh service dependency on network.online in CentOS
matosatti Dec 2, 2025
80719da
Add SELinux rules for ptp_status_vsock
matosatti Dec 3, 2025
08fcce3
Add SELinux rules for ptp4l
matosatti Dec 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions playbooks/seapath_setup_hardened_debian.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
vars:
revert: false
roles:
- detect_seapath_distro
- debian_hardening
- name: Add hardened for SEAPATH physical machines
become: true
Expand Down
16 changes: 14 additions & 2 deletions roles/debian_hardening/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,11 +167,23 @@
state: absent
when: revert

- name: Set default SSH service file path
set_fact:
ssh_service_path: "/lib/systemd/system/ssh.service"
ssh_service_newline: "After=network.target auditd.service network-online.target"
when: seapath_distro != "CentOS"
Copy link
Member

@dupremathieu dupremathieu Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The debian_hardening role is supposed to be a Debian-only role.

You should create a centos_hardening role for CentOS.

If you think more than 80% of the code is common, maybe we can change this role to be a generic hardening role for all distros.

Copy link
Contributor Author

@matosatti matosatti Dec 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dupremathieu i believe more than 80% of the code is common.

Can't we proceed to modify the Debian hardening profile into something that applies to CentOS as well (which will probably work for OracleLinux as well, but needs testing), and then rename it ? (debian_hardening -> hardening).

The steps are mostly generic.

Copy link
Member

@dupremathieu dupremathieu Dec 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, we can definitely do that.
Do you know if your commits are the only adjustment we need to have the hardening roles working on both Debian and CentOS?


- name: Set SSH service file path for CentOS
set_fact:
ssh_service_path: "/lib/systemd/system/sshd.service"
ssh_service_newline: "After=network.target network-online.target"
when: seapath_distro == "CentOS"

- name: Wait for DHCP for SSH
lineinfile:
dest: /lib/systemd/system/ssh.service
dest: "{{ ssh_service_path }}"
regexp: "^After="
line: "After=network.target auditd.service network-online.target"
line: "{{ ssh_service_newline }}"
state: present
when: not revert

Expand Down
8 changes: 8 additions & 0 deletions roles/ptp_status_vsock/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,3 +47,11 @@
name: ptp_vsock.service
enabled: yes
state: started
- name: Allow execution at /var/lib/ptp/ (semanage)
command:
cmd: semanage fcontext -a -t bin_t "/var/lib/ptp(/.*)?"
when: seapath_distro == "CentOS"
- name: Allow execution at /var/lib/ptp/ (restorecon)
command:
cmd: restorecon -r -v /var/lib/ptp/
when: seapath_distro == "CentOS"
Binary file added roles/timemaster/files/ptp4l_local.pp
View file
Open in desktop
Binary file not shown.
10 changes: 10 additions & 0 deletions roles/timemaster/tasks/main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,3 +45,13 @@
name: "{{ timemaster_service_name_chrony }}"
state: stopped
enabled: false
- name: Copy SELinux rule for ptp4l
copy:
src: ptp4l_local.pp
dest: "/tmp/ptp4l_local.pp"
mode: '0755'
when: seapath_distro == "CentOS"
- name: Install SELinux rule for ptp4l
command:
cmd: semodule -i /tmp/ptp4l_local.pp
when: seapath_distro == "CentOS"