LCTL-NODEMAP_SET_SEPOL(8)

NAME
lctl-nodemap_set_sepol - set SELinux policy info on a nodemap

SYNOPSIS
lctl nodemap_set_sepol or
lctl nodemap set_sepol --name NODEMAP --sepol POLICY

DESCRIPTION
nodemap_set_sepol adds SELinux policy info as described by POLICY to the specified NODEMAP. The POLICY string describing the SELinux policy has the following syntax:
    MODE:NAME:VERSION:HASH
    where:

    -MODE
        is a digit telling if SELinux is in Permissive mode (0) or Enforcing mode (1)

    -NAME
        is the name of the SELinux policy

    -VERSION
        is the version of the SELinux policy

    -HASH
        is the computed hash of the binary representation of the policy, as exported in
        /etc/selinux/NAME/policy/policy.VERSION

The reference POLICY string can be obtained on a client node known to enforce the right SELinux policy, by calling the l_getsepol command line utility.

Clients belonging to NODEMAP must enforce the SELinux policy described by POLICY, otherwise they are denied access to the Lustre file system.

OPTIONS

--name NODEMAP
    The name of the nodemap that this SELinux policy info should be associated with.

--sepol POLICY
    is the string describing the SELinux policy that clients must enforce. It has to conform to the syntax described above.

EXAMPLES
    # lctl nodemap_set_sepol --name restricted --sepol '1:mls:31:40afb76d077c441b69af58cccaaa2ca63641ed6e21b0a887dc21a684f508b78f'
    # lctl nodemap_set_sepol --name admins --sepol ''

AVAILABILITY
lctl nodemap_set_sepol is part of the lustre(7) filesystem package since release 2.13.0

SEE ALSO
lustre(7), lctl-nodemap-activate(8), lctl-nodemap-add-idmap(8), lctl-nodemap-add-range(8), lctl-nodemap-del(8), lctl-nodemap-del-idmap(8), lctl-nodemap-del-range(8), lctl-nodemap-modify(8) lctl-nodemap-new(8),