WEBVTT

1
00:00.000 --> 00:04.280
So friends in this particular video, what I want to do is to continue on our

2
00:04.280 --> 00:04.900
path of

3
00:04.900 --> 00:06.580
automating SE Linux.

4
00:06.580 --> 00:10.490
But this time, what I want to do is to show you how we can actually use one of

5
00:10.490 --> 00:11.540
the Ansible

6
00:11.540 --> 00:15.460
system roles or the rail system roles which I'd say to perform this particular

7
00:15.460 --> 00:16.100
action.

8
00:16.100 --> 00:19.740
So with that said, why don't we dive on in and just get to it.

9
00:19.740 --> 00:23.160
So what I'm going to do here is going to my user share document directory and

10
00:23.160 --> 00:23.500
then I

11
00:23.500 --> 00:26.970
should have this folder rail system roles because we have installed this

12
00:26.970 --> 00:27.620
earlier on in

13
00:27.620 --> 00:29.620
the previous scale.

14
00:29.620 --> 00:32.620
If I do an LS, what we're going to see here is we do have this particular
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.620 --> 00:32.620
If I do an LS, what we're going to see here is we do have this particular

15
00:32.620 --> 00:33.440
directory known

16
00:33.440 --> 00:34.440
as SE Linux.

17
00:34.440 --> 00:37.260
So let's go inside here, do an LS.

18
00:37.260 --> 00:41.470
If we just look at the example playbook, let's just open this up and to enter

19
00:41.470 --> 00:43.040
and wow, this

20
00:43.040 --> 00:45.140
looks really, really intimidating.

21
00:45.140 --> 00:49.240
Now the good news is is that a lot of this is just comments and just variable

22
00:49.240 --> 00:49.980
values which

23
00:49.980 --> 00:51.260
you can set.

24
00:51.260 --> 00:55.550
Quite honestly, you can really minimize this a lot, which is exactly what we're

25
00:55.550 --> 00:55.980
going

26
00:55.980 --> 00:58.300
to do in this particular video.

27
00:58.300 --> 01:02.010
But for now, as we can see here, the variables being defined are things like
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.300 --> 01:02.010
But for now, as we can see here, the variables being defined are things like

28
01:02.010 --> 01:02.700
the SE Linux

29
01:02.700 --> 01:03.700
policy.

30
01:03.700 --> 01:07.400
In this case here, we set the value to targeted the SE Linux state set to

31
01:07.400 --> 01:08.380
enforcing if you

32
01:08.380 --> 01:10.900
want to change it to permissive, you could do so.

33
01:10.900 --> 01:14.740
And there are a whole bunch of other configurations relating to SE Linux such

34
01:14.740 --> 01:15.660
as Boolean values

35
01:15.660 --> 01:20.500
as well as how we can specify particular SE Linux f context pretty much that is

36
01:20.500 --> 01:21.300
very similar

37
01:21.300 --> 01:24.460
to what we did in the previous video.

38
01:24.460 --> 01:28.200
In the case here, we use the SE type to specify the label we want to be

39
01:28.200 --> 01:29.100
applying.

40
01:29.100 --> 01:33.410
And then we specify where about we want to target that label, i.e. which
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

40
01:29.100 --> 01:33.410
And then we specify where about we want to target that label, i.e. which

41
01:33.410 --> 01:34.220
directory or

42
01:34.220 --> 01:36.820
file should we actually be applying the label to.

43
01:36.820 --> 01:40.420
In the case here, we see a very similar syntax to what we saw before in the

44
01:40.420 --> 01:41.540
previous video.

45
01:41.540 --> 01:45.990
Whereas in this one, we're targeting everything inside of the test directory

46
01:45.990 --> 01:46.660
and applying the

47
01:46.660 --> 01:48.380
label user home dirty.

48
01:48.380 --> 01:52.220
Now scrolling on down, we can see this as a super comprehensive role.

49
01:52.220 --> 01:56.340
Honestly, so much of what we're seeing here is beyond the scope of the RHC

50
01:56.340 --> 01:57.180
examination.

51
01:57.180 --> 01:58.900
So really don't panic.

52
01:58.900 --> 02:00.300
Definitely do not stress about it.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

52
01:58.900 --> 02:00.300
Definitely do not stress about it.

53
02:00.300 --> 02:03.820
So with respect to the tasks of the playbook, we can see we have a whole bunch

54
02:03.820 --> 02:04.620
of options.

55
02:04.620 --> 02:07.940
But for now, all I'm going to do here is as opposed to going through absolutely

56
02:07.940 --> 02:08.740
everything,

57
02:08.740 --> 02:10.780
let me just show you how we can modify this role.

58
02:10.780 --> 02:14.140
That's created a playbook called play2.yml and this will be much, much more

59
02:14.140 --> 02:14.740
stripped down

60
02:14.740 --> 02:16.220
than the example you just saw.

61
02:16.220 --> 02:18.060
And I really mean much more stripped down.

62
02:18.060 --> 02:22.550
So what's creating name would I say using the SEO Linux role and the host we're

63
02:22.550 --> 02:23.100
going to

64
02:23.100 --> 02:27.660
target will be the all group or set gather facts to be false.

65
02:27.660 --> 02:29.580
And now I'll just define my vars.

66
02:29.580 --> 02:33.450
Now you'll notice in the example, we have this option here for SEO Linux
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:29.580 --> 02:33.450
Now you'll notice in the example, we have this option here for SEO Linux

67
02:33.450 --> 02:34.900
underscore state.

68
02:34.900 --> 02:38.340
And now I can just specify the state that I want SEO Linux to be in.

69
02:38.340 --> 02:42.180
Now right now, if you recall, SEO Linux is in the enforcing state.

70
02:42.180 --> 02:46.270
If I just say SE status, as we can see the current mode is enforcing, meaning

71
02:46.270 --> 02:46.620
that any

72
02:46.620 --> 02:48.900
violations are going to be blocked.

73
02:48.900 --> 02:53.020
What I'm going to do is change the state to permissive using the role.

74
02:53.020 --> 02:56.340
So in this case here, all I'm going to do is change this to permissive.

75
02:56.340 --> 02:59.340
And then I'm going to specify the roles I want to use is going to be the rail

76
02:59.340 --> 02:59.700
hyphen

77
02:59.700 --> 03:04.780
system, hyphen roles dot se lyrics and drum roll.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.700 --> 03:04.780
system, hyphen roles dot se lyrics and drum roll.

78
03:04.780 --> 03:05.780
That is it.

79
03:05.780 --> 03:06.780
Really not joking.

80
03:06.780 --> 03:09.900
This is how much more stripped down this playbook is going to get.

81
03:09.900 --> 03:13.180
So let's save this and let's see if it actually works okay.

82
03:13.180 --> 03:15.540
So let's run the playbook, hit enter, give it a moment.

83
03:15.540 --> 03:16.980
And we actually have an error here.

84
03:16.980 --> 03:20.380
So let's go back in for a moment open because I actually have this additional

85
03:20.380 --> 03:21.140
colon here.

86
03:21.140 --> 03:22.140
Let's just get rid of that.

87
03:22.140 --> 03:23.140
Paul, geez about that.

88
03:23.140 --> 03:24.140
Clear the screen.

89
03:24.140 --> 03:27.540
Arrow up, try again and to enter now the playbook executes.

90
03:27.540 --> 03:28.820
So the playbook completes it.

91
03:28.820 --> 03:31.700
And as we can see, we have a change on both of our devices.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:28.820 --> 03:31.700
And as we can see, we have a change on both of our devices.

92
03:31.700 --> 03:35.290
Let's go back to the devices and confirm if I just arrow up and run the same

93
03:35.290 --> 03:36.620
command again,

94
03:36.620 --> 03:41.110
notice now that the state has been changed to permissive, meaning that se Linux

95
03:41.110 --> 03:41.660
will allow

96
03:41.660 --> 03:42.940
violations.

97
03:42.940 --> 03:45.260
It's simply going to log those violations.

98
03:45.260 --> 03:48.970
And again, over on the second device, on the yellow box, notice this is also in

99
03:48.970 --> 03:49.620
permissive

100
03:49.620 --> 03:50.620
mode.

101
03:50.620 --> 03:53.970
And if I wanted to change things back, well, quite simply, I would just set the

102
03:53.970 --> 03:54.460
state to

103
03:54.460 --> 03:55.460
be enforcing.

104
03:55.460 --> 03:57.020
Let's run the playbook again.

105
03:57.020 --> 03:58.300
And again, we have a change.

106
03:58.300 --> 03:59.980
Let's go to our device, arrow up again.

107
03:59.980 --> 04:03.380
And now we can see the state is back in enforcing mode.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

107
03:59.980 --> 04:03.380
And now we can see the state is back in enforcing mode.

108
04:03.380 --> 04:07.520
So really with respect to our examples right here, pretty much just use this as

109
04:07.520 --> 04:08.060
a general

110
04:08.060 --> 04:09.060
template.

111
04:09.060 --> 04:12.890
If I go back into my se Linux right here and I again look at the example, say

112
04:12.890 --> 04:13.700
for example,

113
04:13.700 --> 04:16.860
I wanted to maybe change my se Linux context labels.

114
04:16.860 --> 04:17.860
Okay.

115
04:17.860 --> 04:19.860
So what I could do is copy the f context right here.

116
04:19.860 --> 04:23.100
And we also effectively want to run the restore con command.

117
04:23.100 --> 04:24.100
Okay.

118
04:24.100 --> 04:27.020
So let's just grab these two examples right here, copy here.

119
04:27.020 --> 04:30.900
And all I will do is I'll copy play to and I'll create a file called play three
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

119
04:27.020 --> 04:30.900
And all I will do is I'll copy play to and I'll create a file called play three

120
04:30.900 --> 04:31.300
dot YML.

121
04:31.300 --> 04:33.420
So let's go into this particular file.

122
04:33.420 --> 04:36.140
And all I'll do is I'll delete this variable here.

123
04:36.140 --> 04:39.380
And instead I will just paste in this information.

124
04:39.380 --> 04:41.940
All I will do here is I'll just change some of the values.

125
04:41.940 --> 04:44.980
So that's going to create a directory called pizza.

126
04:44.980 --> 04:48.460
And as opposed to setting the type to user home dirty, I would just set it to

127
04:48.460 --> 04:48.940
the same

128
04:48.940 --> 04:53.580
one we saw before the HCDPD, sys content T.

129
04:53.580 --> 04:57.040
And again, remember the syntax pretty much any sub directories or files we

130
04:57.040 --> 04:57.780
create within

131
04:57.780 --> 05:02.060
this pizza directory is also going to inherit this particular label.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:57.780 --> 05:02.060
this pizza directory is also going to inherit this particular label.

132
05:02.060 --> 05:04.900
And again, what's directory do we want to be restoring?

133
05:04.900 --> 05:07.180
We want to restore the labels for the pizza directory.

134
05:07.180 --> 05:10.900
So all I will do here, in fact, before I run this, let's just change this to

135
05:10.900 --> 05:11.380
just be the

136
05:11.380 --> 05:12.380
yellow box.

137
05:12.380 --> 05:15.300
And I'll go and create the pizza directory on that yellow box.

138
05:15.300 --> 05:16.580
So this is to the nk.

139
05:16.580 --> 05:18.180
forward slash pizza.

140
05:18.180 --> 05:22.660
And if I do an LS dash LZ on the right directory, we can see here right now the

141
05:22.660 --> 05:23.780
pizza directory

142
05:23.780 --> 05:28.580
actually has the tag of default underscore T. We want to change it so that it

143
05:28.580 --> 05:28.940
looks the

144
05:28.940 --> 05:30.980
same as what we see on my site.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

144
05:28.940 --> 05:30.980
same as what we see on my site.

145
05:30.980 --> 05:31.980
Okay.

146
05:31.980 --> 05:35.310
So let's go back to the playbook and we'll just as well play book play three

147
05:35.310 --> 05:35.780
dot YML and

148
05:35.780 --> 05:40.500
to enter and we'll just give it a moment to let the playbook execute.

149
05:40.500 --> 05:41.740
And we can see a change.

150
05:41.740 --> 05:43.620
So let's now go back to our yellow box.

151
05:43.620 --> 05:47.010
If I add a warp and run the same command and to enter check this out right here

152
05:47.010 --> 05:47.300
.

153
05:47.300 --> 05:52.700
The pizza directory now has the new label, the 80 DPD, SIS content T.

154
05:52.700 --> 05:56.380
So really, like I said, do not be intimidated by all the commands and options

155
05:56.380 --> 05:56.980
within the

156
05:56.980 --> 05:58.420
example playbook.

157
05:58.420 --> 06:02.370
Just pick and choose as you need and modify them to make your own playbook for
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

157
05:58.420 --> 06:02.370
Just pick and choose as you need and modify them to make your own playbook for

158
06:02.370 --> 06:02.860
your own