aboutsummaryrefslogtreecommitdiffstats
path: root/manifests/selinux.pp
blob: c5d13e2b6c0353c8754e45fcc9c6903d63cd4a69 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
#
# Copyright (C) 2014 eNovance SAS <licensing@enovance.com>
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# == Class: tripleo::selinux
#
# Helper class to configure SELinux on nodes
#
# === Parameters:
#
# [*mode*]
#   (optional) SELinux mode the system should be in
#   Defaults to 'enforcing'
#   Possible values : disabled, permissive, enforcing
#
# [*directory*]
#   (optional) Path where to find the SELinux modules
#   Defaults to '/usr/share/selinux'
#
# [*booleans*]
#   (optional) Set of booleans to persistently enables
#   SELinux booleans are the one getsebool -a returns
#   Defaults []
#   Example: ['rsync_full_access', 'haproxy_connect_any']
#
# [*modules*]
#   (optional) Set of modules to load on the system
#   Defaults []
#   Example: ['module1', 'module2']
#   Note: Those module should be in the $directory path
#
class tripleo::selinux (
  $mode      = 'enforcing',
  $directory = '/usr/share/selinux/',
  $booleans  = [],
  $modules   = [],
) {

  if $::osfamily != 'RedHat'  {
    fail("OS family unsuppored yet (${::osfamily}), SELinux support is only limited to RedHat family OS")
  }

  Selboolean {
    persistent => true,
    value      => 'on',
  }

  Selmodule {
    ensure       => present,
    selmoduledir => $directory,
  }

  file { '/etc/selinux/config':
    ensure  => present,
    mode    => '0444',
    content => template('tripleo/selinux/sysconfig_selinux.erb')
  }

  $current_mode = $::selinux? {
    false   => 'disabled',
    default => $::selinux_current_mode,
  }

  if $current_mode != $mode {
    case $mode {
      /^(disabled|permissive)$/: {
        if $current_mode == 'enforcing' {
          exec { '/sbin/setenforce 0': }
        }
      }
      'enforcing': {
        exec { '/sbin/setenforce 1': }
      }
      default: {
        fail('You must specify a mode (enforcing, permissive, or disabled)')
      }
    }
  }

  selboolean { $booleans :
    persistent => true,
  }
  selmodule { $modules: }

}