Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add $selinux_ignore_defaults parameter with default value true #1043

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add $selinux_ignore_defaults parameter with default value true #1043

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3f86c9c
Add $selinux_ignore_defaults parameter with default value true
wbclark Apr 22, 2022
a02e37a
Do not pre-install redis in acceptance node.
wbclark Apr 22, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 11 additions & 9 deletions manifests/config.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,10 +57,11 @@
)
$min_puma_threads = pick($foreman::foreman_service_puma_threads_min, $foreman::foreman_service_puma_threads_max)
systemd::dropin_file { 'foreman-service':
filename => 'installer.conf',
unit => "${foreman::foreman_service}.service",
content => template('foreman/foreman.service-overrides.erb'),
notify_service => true,
filename => 'installer.conf',
unit => "${foreman::foreman_service}.service",
content => template('foreman/foreman.service-overrides.erb'),
notify_service => true,
selinux_ignore_defaults => $foreman::selinux_ignore_defaults,
}

if ! defined(File[$foreman::app_root]) {
Expand Down Expand Up @@ -223,10 +224,11 @@
}

systemd::dropin_file { 'foreman-socket':
ensure => bool2str($foreman_socket_override =~ Undef, 'absent', 'present'),
filename => 'installer.conf',
unit => "${foreman::foreman_service}.socket",
content => $foreman_socket_override,
notify_service => true,
ensure => bool2str($foreman_socket_override =~ Undef, 'absent', 'present'),
filename => 'installer.conf',
unit => "${foreman::foreman_service}.socket",
content => $foreman_socket_override,
notify_service => true,
selinux_ignore_defaults => $foreman::selinux_ignore_defaults,
}
}
3 changes: 3 additions & 0 deletions manifests/globals.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,8 @@
# @param vhost_priority
# Defines Apache vhost priority for the Foreman vhost conf file.
#
# @param selinux_ignore_defaults
# Do not lookup default security context for file resources in catalogue compilation and attempt to manage them; instead defer context lookups to the system itself when the files are actually created. Useful during initial installs, because Puppet can install packages which modify the security policy after the context lookups were performed, which breaks idempotence. This can be disabled after the initial install, to allow Puppet to remedy drift in security context.
class foreman::globals (
Optional[String] $plugin_prefix = undef,
Boolean $manage_user = true,
Expand All @@ -33,5 +35,6 @@
Stdlib::Absolutepath $app_root = '/usr/share/foreman',
String[1] $rails_env = 'production',
String[1] $vhost_priority = '05',
Boolean $selinux_ignore_defaults = true,
) {
}
9 changes: 9 additions & 0 deletions manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,8 @@
#
# $dynflow_redis_url:: If set, the redis server is not managed and we use the defined url to connect
#
# $selinux_ignore_defaults:: Do not lookup default security context for file resources in catalogue compilation and attempt to manage them; instead defer context lookups to the system itself when the files are actually created. Useful during initial installs, because Puppet can install packages which modify the security policy after the context lookups were performed, which breaks idempotence. This can be disabled after the initial install, to allow Puppet to remedy drift in security context.
#
# === Keycloak parameters:
#
# $keycloak:: Enable Keycloak support. Note this is limited
Expand Down Expand Up @@ -291,6 +293,7 @@
String[1] $keycloak_app_name = $foreman::params::keycloak_app_name,
String[1] $keycloak_realm = $foreman::params::keycloak_realm,
Boolean $register_in_foreman = $foreman::params::register_in_foreman,
Boolean $selinux_ignore_defaults = $foreman::params::selinux_ignore_defaults,
) inherits foreman::params {
assert_type(Array[Stdlib::IP::Address], $trusted_proxies)

Expand All @@ -313,6 +316,12 @@
include foreman::database
contain foreman::service

if $facts['os']['selinux']['enabled'] {
File {
selinux_ignore_defaults => $foreman::selinux_ignore_defaults,
}
}
Comment on lines +319 to +323
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm against this. It's way too broad and magic. Pretty sure this affects the whole catalog, not just the files created by this module.

Instead, can we set the property everywhere? It's more verbose, but also easier to follow.


Anchor <| title == 'foreman::repo' |> ~> Class['foreman::install']
Class['foreman::install'] ~> Class['foreman::config', 'foreman::service']
Class['foreman::config'] ~> Class['foreman::database', 'foreman::service']
Expand Down
8 changes: 0 additions & 8 deletions spec/setup_acceptance_node.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,14 +2,6 @@
repo => 'nightly',
}

# Needed for idempotency when SELinux is enabled
if $foreman::repo::configure_scl_repo {
package { 'rh-redis5-redis':
ensure => installed,
require => Class['foreman::repo'],
}
}
Comment on lines -5 to -11
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We've dropped EL7 so this should no longer be needed.


# Not /etc/foreman because purging removes that
$directory = '/etc/foreman-certs'
$certificate = "${directory}/certificate.pem"
Expand Down