diff options
| author |   Jiri Stransky <jistr@redhat.com> | 2015-07-13 19:11:54 +0200 |
|---|---|---|
| committer | Jiri Stransky <jistr@redhat.com> | 2015-07-13 19:11:54 +0200 |
| commit | 9ab0050e6ec6ace2deb7712d7fde7a12bc466b75 (patch) | |
| tree | 9c8323fece58f04eecc8f77fee5213c54c387251 /puppet/manifests/overcloud_cephstorage.pp | |
| parent | 0405a6b248a8328edc1ca050be7e33f436b29c77 (diff) | |
Ensure SELinux is permissive on Ceph OSDs
Currently we build the overcloud image with selinux-permissive element
in CI. However, even in environments where selinux-permissive element is
not used, it should be ensured that SELinux is set to permissive mode on
nodes with Ceph OSD [1].
We have no nice way to manage SELinux status via Puppet at the moment,
so i'm resorting to execs, but with proper "onlyif" guards.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1241422
Change-Id: I31bd685ad4800261fd317eef759bcfd285f2ba80
Diffstat (limited to 'puppet/manifests/overcloud_cephstorage.pp')
| -rw-r--r-- | puppet/manifests/overcloud_cephstorage.pp | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/puppet/manifests/overcloud_cephstorage.pp b/puppet/manifests/overcloud_cephstorage.pp index 21fd5f98..38b6a546 100644 --- a/puppet/manifests/overcloud_cephstorage.pp +++ b/puppet/manifests/overcloud_cephstorage.pp @@ -30,6 +30,20 @@ if count(hiera('ntp::servers')) > 0 { include ::ntp } +if str2bool(hiera('ceph_osd_selinux_permissive', true)) { + exec { 'set selinux to permissive on boot': + command => "sed -ie 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config", + onlyif => "test -f /etc/selinux/config && ! grep '^SELINUX=permissive' /etc/selinux/config", + path => ["/usr/bin", "/usr/sbin"], + } + + exec { 'set selinux to permissive': + command => "setenforce 0", + onlyif => "which setenforce && getenforce | grep -i 'enforcing'", + path => ["/usr/bin", "/usr/sbin"], + } -> Class['ceph::profile::osd'] +} + include ::ceph::profile::client include ::ceph::profile::osd |