diff -r a2342f26c9de -r b0b56e0f8c7f dev/provisioning/modules/yum/manifests/versionlock.pp
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/dev/provisioning/modules/yum/manifests/versionlock.pp	Fri Jan 15 15:35:00 2016 +0100
@@ -0,0 +1,56 @@
+# Define: yum::versionlock
+#
+# This definition locks package from updates.
+#
+# Parameters:
+#   [*ensure*] - specifies if versionlock should be present, absent or exclude
+#   [*path*]   - configuration of Yum plugin versionlock
+#
+# Actions:
+#
+# Requires:
+#   RPM based system, Yum versionlock plugin
+#
+# Sample usage:
+#   yum::versionlock { '0:bash-4.1.2-9.el6_2.*':
+#     ensure  => present,
+#   }
+#
+define yum::versionlock (
+  $ensure = present,
+  $path   = '/etc/yum/pluginconf.d/versionlock.list'
+) {
+  require yum::plugin::versionlock
+
+  if ($name =~ /^[0-9]+:.+\*$/) {
+    $_name = $name
+  } elsif ($name =~ /^[0-9]+:.+-.+-.+\./) {
+    $_name= "${name}*"
+  } else {
+    fail('Package name must be formated as \'EPOCH:NAME-VERSION-RELEASE.ARCH\'')
+  }
+
+  case $ensure {
+    present,absent,exclude: {
+      if ($ensure == present) or ($ensure == absent) {
+        file_line { "versionlock.list-${name}":
+          ensure => $ensure,
+          line   => $_name,
+          path   => $path,
+        }
+      }
+
+      if ($ensure == exclude) or ($ensure == absent) {
+        file_line { "versionlock.list-!${name}":
+          ensure => $ensure,
+          line   => "!${_name}",
+          path   => $path,
+        }
+      }
+    }
+
+    default: {
+      fail("Invalid ensure state: ${ensure}")
+    }
+  }
+}