LCTL-NODEMAP_SET_SEPOL(8)

📦 version 2.17.58, in ubuntu stonking

💖 lctl-nodemap_set_sepol — set SELinux policy info on a nodemap 💖

okay so bestie, welcome to a page from the Lustre Configuration Utilities manual, section 8. the star of the show is lctl-nodemap_set_sepol, and yes it's giving serious sysadmin main character energy ✨

🌸 NAME 🌸

lctl-nodemap_set_sepol — set SELinux policy info on a nodemap. that's it, that's the whole job, and it does it beautifully 💅

🦋 SYNOPSIS 🦋

lctl nodemap_set_sepol

or

lctl nodemap set_sepol --name NODEMAP --sepol POLICY

two ways in, same destination. pick your fighter 🫶

✨ DESCRIPTION ✨

nodemap_set_sepol takes SELinux policy info — the stuff described by POLICY — and attaches it to the NODEMAP you picked. no cap.

the POLICY string describing the SELinux policy has this syntax, and it's non-negotiable, she's structured:

MODE:NAME:VERSION:HASH

where, one by one, because bestie we do not skip details on this page:

  • -MODE — a digit telling if SELinux is in Permissive mode (0) or Enforcing mode (1)
  • -NAME — is the name of the SELinux policy
  • -VERSION — is the version of the SELinux policy
  • -HASH — is the computed hash of the binary representation of the policy, as exported in /etc/selinux/NAME/policy/policy.VERSION

(the fact that I just listed -MODE, -NAME, -VERSION and -HASH exactly like that? iconic, we love a faithful reproduction 💀)

the reference POLICY string can be obtained on a client node known to enforce the right SELinux policy, by calling the l_getsepol command line utility. so like, don't just make it up, go ask a node that already knows 🧚

⚠️ heads up: clients belonging to NODEMAP must enforce the SELinux policy described by POLICY, otherwise they are denied access to the Lustre file system. no policy match, no entry. that's the vibe check and they failed it 😭

🎀 OPTIONS 🎀

  • --name NODEMAP — the name of the nodemap that this SELinux policy info should be associated with. like, which nodemap are we doing this for, bestie.
  • --sepol POLICY — is the string describing the SELinux policy that clients must enforce. it has to conform to the syntax described above, so MODE:NAME:VERSION:HASH or it's a no from me 🙈

🌈 EXAMPLES 🌈

here's the good stuff, real commands, watch how it's done:

# lctl nodemap_set_sepol --name restricted --sepol '1:mls:31:40afb76d077c441b69af58cccaaa2ca63641ed6e21b0a887dc21a684f508b78f'
# lctl nodemap_set_sepol --name admins --sepol ''

first one: full policy string, Enforcing mode, name mls, version 31, and a whole delicious hash. second one: empty string for the admins nodemap, which is lowkey a whole mood 🍓

⭐ AVAILABILITY ⭐

lctl nodemap_set_sepol is part of the lustre(7) filesystem package since release 2.13.0. so if you're on 2.13.0 or later, she's there waiting for you 💜

👑 SEE ALSO 👑

go read these next, i'm obsessed with all of them tbh:

okay that's the whole page, and per the footer this gem is from Lustre, dated 2024-08-14, and its manual page tag is LCTL-NODE...SET_SEPOL(8) — yes the source truncated her name, she's still that girl 💅✨ periodt.

📦 where this page comes from