LCTL-NODEMAP_SET_SEPOL(8)

NAME
lctl-nodemap_set_sepol - set SELinux policy info on a nodemap

SYNOPSIS
lctl nodemap_set_sepol --name <nodemap> --sepol <sepol>

DESCRIPTION
nodemap_set_sepol adds SELinux policy info as described by sepol to the specified nodemap. The sepol string describing the SELinux policy has the following syntax: <mode>:<name>:<version>:<hash> where:
    - <mode> is a digit telling if SELinux is in Permissive mode (0) or Enforcing mode (1) - <name> is the name of the SELinux policy - <version> is the version of the SELinux policy - <hash> is the computed hash of the binary representation of the policy, as exported in /etc/selinux/<name>/policy/policy.<version>
The reference sepol string can be obtained on a client node known to enforce the right SELinux policy, by calling the l_getsepol command line utility. Clients belonging to nodemap must enforce the SELinux policy described by sepol, otherwise they are denied access to the Lustre file system.

OPTIONS
nodemap is the name of the nodemap that this SELinux policy info should be associated with. sepol is the string describing the SELinux policy that clients must enforce. It has to conform to the syntax described above.

EXAMPLES
# lctl nodemap_set_sepol --name restricted --sepol '1:mls:31:40afb76d077c441b69af58cccaaa2ca63641ed6e21b0a887dc21a684f508b78f'
# lctl nodemap_set_sepol --name admins --sepol ''

AVAILABILITY
lctl is part of the Lustre(7) filesystem package.

SEE ALSO
lustre(7), lctl-nodemap-activate(8), lctl-nodemap-add(8), lctl-nodemap-del(8), lctl-nodemap-del-range(8), lctl-nodemap-add-idmap(8), lctl-nodemap-del-idmap(8), lctl-nodemap-modify(8)