Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

install icinga2-selinux #602

Merged
merged 9 commits into from
Feb 20, 2020
Merged

install icinga2-selinux #602

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
8d9d51d
Add selinux support
b3n4kh Nov 12, 2019
5b5a8d0
exec restorecon
b3n4kh Nov 14, 2019
f98ce68
Add selinux support
b3n4kh Nov 12, 2019
65c0d92
exec restorecon
b3n4kh Nov 14, 2019
a4ad248
Merge branch 'selinux' of github.com:b3n4kh/puppet-icinga2 into selinux
b3n4kh Jan 11, 2020
d5fde3d
Add hieradata for manage_selinux, remove oboslete exec for manage_sel…
b3n4kh Jan 27, 2020
66749ac
fix missing qoutes in Redhat hiera yaml
b3n4kh Jan 27, 2020
dc64745
facts only come as strings, maybe use an ENUM as datatype? fix typo i…
b3n4kh Jan 27, 2020
c689cea
selinux_name shouldn't be required
b3n4kh Jan 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions data/Linux-kernel.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
---
icinga2::globals::package_name: icinga2
icinga2::globals::service_name: icinga2
icinga2::globals::selinux_name: icinga2-selinux
icinga2::globals::service_reload: service icinga2 reload
icinga2::globals::ido_mysql_package_name: icinga2-ido-mysql
icinga2::globals::ido_mysql_schema: /usr/share/icinga2-ido-mysql/schema/mysql.sql
Expand Down
2 changes: 2 additions & 0 deletions data/RedHat-family-7.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
---
icinga2::manage_selinux: "%{facts.os.selinux.enabled}"
2 changes: 2 additions & 0 deletions data/RedHat-family-8.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,2 @@
---
icinga2::manage_selinux: "%{facts.os.selinux.enabled}"
4 changes: 4 additions & 0 deletions manifests/globals.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@
# [*package_name*]
# The name of the icinga package to manage.
#
# [*selinux_name*]
# The name of the icinga selinux package.
#
# [*service_name*]
# The name of the icinga service to manage.
#
Expand Down Expand Up @@ -99,6 +102,7 @@
Optional[String] $ido_mysql_package_name = undef,
Optional[String] $ido_pgsql_package_name = undef,
Optional[String] $service_reload = undef,
Optional[String] $selinux_name = unde,
) {

assert_private()
Expand Down
4 changes: 4 additions & 0 deletions manifests/init.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,9 @@
# [*manage_package*]
# If set to false packages aren't managed. Defaults to true.
#
# [*manage_selinux*]
# If set to true the icinga selinux package is installed. Defaults to false.
#
# [*manage_service*]
# If set to true the service is managed otherwise the service also
# isn't restarted if a config file changed. Defaults to true.
Expand Down Expand Up @@ -144,6 +147,7 @@
Boolean $enable = true,
Boolean $manage_repo = false,
Boolean $manage_package = true,
Variant[Boolean, String] $manage_selinux = false,
Boolean $manage_service = true,
Boolean $purge_features = true,
Hash $constants = {},
Expand Down
9 changes: 9 additions & 0 deletions manifests/install.pp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@

$package_name = $::icinga2::globals::package_name
$manage_package = $::icinga2::manage_package
$selinux_name = $::icinga2::globals::selinux_name
$manage_selinux = $::icinga2::manage_selinux
$cert_dir = $::icinga2::globals::cert_dir
$conf_dir = $::icinga2::globals::conf_dir
$user = $::icinga2::globals::user
Expand All @@ -30,6 +32,13 @@
ensure => installed,
before => File[$cert_dir, $conf_dir],
}

if str2bool($manage_selinux) {
package { $selinux_name:
ensure => installed,
require => Package[$package_name],
}
}
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Two things I have in mind here:

  • Limit this to osfamily - redhat
  • Why the manual restorecon exec?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Limit to RedHat family isn't needed. SELinux is included since kernel 2.6 and not limited to RedHat systems. But of course the icinga project only distributes packages for RedHat family. Maybe this will change in the future.

We switched to module data in puppet-icinga2 v2.0 so you're able to use your own configured package. In this case it's important that the default fit to the operating system or is set to false.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since there is no package icinga2-selinux on distributions other than RHEL, I'd opt for the osfamily as otherwise the manifest will fail on Debian and alike. Even if you manage all that with a boolean up front.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Default to false to all platforms (include Debian), the puppet run will be finished without any errors. If you set selinux to true you have to know what you're doing.

Starts with module data it isn't accepted to set such limits anymore. Because now you can extend the module with your own packages or packages for not supported platform.

}

file { [$cert_dir, $conf_dir]:
Expand Down