security

Manages SELinux settings (global mode and named booleans) and AppArmor per-profile modes. Each declaration performs exactly one operation, selected by which params are set. Idempotent: re-applying an unchanged declaration reports no change.

Category: SSH & security

States

State	Meaning
`present`	The declared setting holds: the SELinux mode, the SELinux boolean value, or the AppArmor profile mode is converged. These are settings, not items — `absent` is not supported.

Parameters

Parameter	Type	Description
`mode`	string	SELinux global mode (op selector): `enforcing`, `permissive`, or `disabled`. Sets `SELINUX=` in `/etc/selinux/config` persistently and, when feasible, `setenforce` at runtime. Mutually exclusive with `boolean` and `apparmor.profile`.
`boolean`	string	SELinux boolean name to toggle (op selector), e.g. `httpd_can_network_connect`. Requires `value`. Mutually exclusive with `mode` and `apparmor.profile`.
`value`	bool	Desired state for `boolean`. Accepts `on`/`off`, `true`/`false`, `yes`/`no`, `1`/`0`. Only valid with `boolean`.
`apparmor.profile`	string	AppArmor profile name as `aa-status` reports it — usually the confined program’s path, e.g. `/usr/bin/foo` (op selector). Requires `apparmor.profile_mode`. Mutually exclusive with `mode` and `boolean`.
`apparmor.profile_mode`	string	AppArmor profile mode: `enforce`, `complain`, or `disable` (`disable` converges to the profile being unloaded). Only valid with `apparmor.profile`.

Examples

Set the global SELinux mode

security:
  set-selinux-enforcing:
    state: present
    mode: enforcing

Toggle a SELinux boolean

security:
  allow-httpd-network:
    state: present
    boolean: httpd_can_network_connect
    value: on

Put an AppArmor profile into complain mode

security:
  nginx-apparmor-complain:
    state: present
    apparmor.profile: /usr/sbin/nginx
    apparmor.profile_mode: complain

Notes

Experimental, partial support; present only (see docs/project/STATE-SUPPORT-MATRIX.md).
SELinux mode: disabled cannot transition at runtime — the persistent edit applies, but a reboot is required for the runtime to go disabled. The Apply comment says so.
Exactly one of mode, boolean, or apparmor.profile must be set per declaration; the operation is identified by which params are present.
Out of scope in v0.1: SELinux file contexts (semanage fcontext / restorecon), port labels, module install (semodule), login/user mappings; AppArmor whole-subsystem enable/disable and profile load/reload; runtime-only mode sets without touching the persistent config.

nftables ssh