diff options
author | Jiri Stransky <jistr@redhat.com> | 2015-07-13 19:11:54 +0200 |
---|---|---|
committer | Jiri Stransky <jistr@redhat.com> | 2015-07-13 19:11:54 +0200 |
commit | 9ab0050e6ec6ace2deb7712d7fde7a12bc466b75 (patch) | |
tree | 9c8323fece58f04eecc8f77fee5213c54c387251 /puppet/manifests/overcloud_controller.pp | |
parent | 0405a6b248a8328edc1ca050be7e33f436b29c77 (diff) |
Ensure SELinux is permissive on Ceph OSDs
Currently we build the overcloud image with selinux-permissive element
in CI. However, even in environments where selinux-permissive element is
not used, it should be ensured that SELinux is set to permissive mode on
nodes with Ceph OSD [1].
We have no nice way to manage SELinux status via Puppet at the moment,
so i'm resorting to execs, but with proper "onlyif" guards.
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1241422
Change-Id: I31bd685ad4800261fd317eef759bcfd285f2ba80
Diffstat (limited to 'puppet/manifests/overcloud_controller.pp')
-rw-r--r-- | puppet/manifests/overcloud_controller.pp | 14 |
1 files changed, 14 insertions, 0 deletions
diff --git a/puppet/manifests/overcloud_controller.pp b/puppet/manifests/overcloud_controller.pp index 777ebad6..1408feaf 100644 --- a/puppet/manifests/overcloud_controller.pp +++ b/puppet/manifests/overcloud_controller.pp @@ -193,6 +193,20 @@ if hiera('step') >= 2 { } if str2bool(hiera('enable_ceph_storage', 'false')) { + if str2bool(hiera('ceph_osd_selinux_permissive', true)) { + exec { 'set selinux to permissive on boot': + command => "sed -ie 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config", + onlyif => "test -f /etc/selinux/config && ! grep '^SELINUX=permissive' /etc/selinux/config", + path => ["/usr/bin", "/usr/sbin"], + } + + exec { 'set selinux to permissive': + command => "setenforce 0", + onlyif => "which setenforce && getenforce | grep -i 'enforcing'", + path => ["/usr/bin", "/usr/sbin"], + } -> Class['ceph::profile::osd'] + } + include ::ceph::profile::client include ::ceph::profile::osd } |