rework pull request #602 from b3n4kh/selinux

voxpupuli · Feb 21, 2020 · d8f962d · d8f962d
1 parent d96f713
commit d8f962d
Show file tree

Hide file tree

Showing 9 changed files with 27 additions and 21 deletions.
diff --git a/data/Linux-kernel.yaml b/data/Linux-kernel.yaml
@@ -1,7 +1,6 @@
 ---
 icinga2::globals::package_name: icinga2
 icinga2::globals::service_name: icinga2
-icinga2::globals::selinux_name: icinga2-selinux
 icinga2::globals::service_reload: service icinga2 reload
 icinga2::globals::ido_mysql_package_name: icinga2-ido-mysql
 icinga2::globals::ido_mysql_schema: /usr/share/icinga2-ido-mysql/schema/mysql.sql

diff --git a/data/RedHat-family-5.yaml b/data/RedHat-family-5.yaml
@@ -1,2 +1,3 @@
 ---
 icinga2::globals::icinga2_bin: /usr/sbin/icinga2
+icinga2::manage_selinux: false
diff --git a/data/RedHat-family-6.yaml b/data/RedHat-family-6.yaml
@@ -1,2 +1,3 @@
 ---
 icinga2::globals::icinga2_bin: /usr/sbin/icinga2
+icinga2::manage_selinux: false
diff --git a/data/RedHat-family-7.yaml b/data/RedHat-family-7.yaml
diff --git a/data/RedHat-family-8.yaml b/data/RedHat-family-8.yaml
diff --git a/data/RedHat-family.yaml b/data/RedHat-family.yaml
@@ -2,9 +2,11 @@
 icinga2::globals::user: icinga
 icinga2::globals::group: icinga
 icinga2::globals::icinga2_bin: /sbin/icinga2
+icinga2::globals::selinux_package_name: icinga2-selinux
 icinga2::repo:
   baseurl: 'http://packages.icinga.com/epel/%{facts.os.release.major}/release/'
   descr: ICINGA (stable release for epel)
   enabled: 1
   gpgcheck: 1
   gpgkey: http://packages.icinga.com/icinga.key
+icinga2::manage_selinux: "%{facts.os.selinux.enforced}"
diff --git a/manifests/globals.pp b/manifests/globals.pp
@@ -11,9 +11,6 @@
 # [*package_name*]
 #   The name of the icinga package to manage.
 #
-# [*selinux_name*]
-#   The name of the icinga selinux package.
-#
 # [*service_name*]
 #   The name of the icinga service to manage.
 #
@@ -27,6 +24,9 @@
 #   CAUTION: This does not manage the group context for the runnig icinga 2 process!
 #   The parameter is only used for group membership of files or directories.
 #
+# [*selinux_package_name*]
+#   The name of the icinga selinux package.
+#
 # [*ido_mysql_package_name*]
 #   The name of the icinga package that's needed for MySQL.
 #   
@@ -99,10 +99,10 @@
   Array[String]          $reserved,
   Optional[String]       $user                   = undef,
   Optional[String]       $group                  = undef,
+  Optional[String]       $selinux_package_name   = undef,
   Optional[String]       $ido_mysql_package_name = undef,
   Optional[String]       $ido_pgsql_package_name = undef,
   Optional[String]       $service_reload         = undef,
-  Optional[String]       $selinux_name           = unde,
 ) {
 
   assert_private()

diff --git a/manifests/init.pp b/manifests/init.pp
@@ -20,7 +20,8 @@
 #   If set to false packages aren't managed. Defaults to true.
 #
 # [*manage_selinux*]
-#   If set to true the icinga selinux package is installed. Defaults to false.
+#   If set to true the icinga selinux package is installed. Default on RedHat family is `facts.os.selinux.enforcing`
+#   otherwise set to false. Requires a `selinux_package_name` (icinga2::globals) and `manage_package` has to be set to true.
 #
 # [*manage_service*]
 #   If set to true the service is managed otherwise the service also

diff --git a/manifests/install.pp b/manifests/install.pp
@@ -16,14 +16,14 @@
 
   assert_private()
 
-  $package_name   = $::icinga2::globals::package_name
-  $manage_package = $::icinga2::manage_package
-  $selinux_name   = $::icinga2::globals::selinux_name
-  $manage_selinux = $::icinga2::manage_selinux
-  $cert_dir       = $::icinga2::globals::cert_dir
-  $conf_dir       = $::icinga2::globals::conf_dir
-  $user           = $::icinga2::globals::user
-  $group          = $::icinga2::globals::group
+  $package_name         = $::icinga2::globals::package_name
+  $manage_package       = $::icinga2::manage_package
+  $selinux_package_name = $::icinga2::globals::selinux_package_name
+  $manage_selinux       = $::icinga2::manage_selinux
+  $cert_dir             = $::icinga2::globals::cert_dir
+  $conf_dir             = $::icinga2::globals::conf_dir
+  $user                 = $::icinga2::globals::user
+  $group                = $::icinga2::globals::group
 
   if $manage_package {
     if $::osfamily == 'windows' { Package { provider => chocolatey, } }
@@ -33,15 +33,21 @@
       before => File[$cert_dir, $conf_dir],
     }
 
-    if str2bool($manage_selinux) {
-      package { $selinux_name:
+    if str2bool($manage_selinux) and $selinux_package_name {
+      package { $selinux_package_name:
         ensure  => installed,
         require => Package[$package_name],
       }
     }
   }
 
-  file { [$cert_dir, $conf_dir]:
+  file { [$conf_dir]:
+    ensure => directory,
+    owner  => $user,
+    group  => $group,
+  }
+
+  file { [$cert_dir]:
     ensure => directory,
     owner  => $user,
     group  => $group,