tmakinen/puppet
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

SELinux fixes for puppetmaster data directories.

Browse source
This commit is contained in:
Timo Mkinen 2012-10-30 12:00:49 +02:00
parent 2555300994
commit cd0c426681
1 changed files with 22 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
puppet/manifests/init.pp
View file

@ -194,9 +194,11 @@ class puppet::server {
class puppet::server::common inherits puppet::client { class puppet::server::common inherits puppet::client {
if $::operatingsystem == "CentOS" and $::operatingsystemrelease =~ /^[1-5]\..*/ { if $::operatingsystem == "CentOS" and $::operatingsystemrelease =~ /^[1-5]\..*/ {
$seltype = "var_lib_t" $seltype_readonly = "var_lib_t"
$seltype_writable = "var_lib_t"
} else { } else {
$seltype = "puppet_var_lib_t" $seltype_readonly = "puppetmaster_t"
$seltype_writable = "puppet_var_lib_t"
} }
case $operatingsystem { case $operatingsystem {
@ -294,17 +296,21 @@ class puppet::server::common inherits puppet::client {
"openbsd" => "wheel", "openbsd" => "wheel",
default => "root", default => "root",
}, },
seltype => $seltype, seltype => $seltype_readonly,
require => Package["puppetmaster"], require => Package["puppetmaster"],
} }
selinux::manage_fcontext { "${puppet_datadir}(/.*)?": selinux::manage_fcontext { "${puppet_datadir}(/.*)?":
type => $seltype, type => $seltype_readonly,
before => File[$puppet_datadir], before => File[$puppet_datadir],
} }
selinux::manage_fcontext { "${puppet_datadir}/(bucket|reports|rrd)(/.*)?":
type => $seltype_writable,
before => File["/srv/puppet/reports"],
}
file { "/srv/puppet": file { "/srv/puppet":
ensure => link, ensure => link,
target => $puppet_datadir, target => $puppet_datadir,
seltype => $seltype, seltype => $seltype_readonly,
require => File[$puppet_datadir], require => File[$puppet_datadir],
} }
} else { } else {
@ -316,14 +322,18 @@ class puppet::server::common inherits puppet::client {
"openbsd" => "wheel", "openbsd" => "wheel",
default => "root", default => "root",
}, },
seltype => $seltype, seltype => $seltype_readonly,
require => Package["puppetmaster"], require => Package["puppetmaster"],
} }
} }
selinux::manage_fcontext { "/srv/puppet(/.*)?": selinux::manage_fcontext { "/srv/puppet(/.*)?":
type => $seltype, type => $seltype_readonly,
before => File["/srv/puppet"], before => File["/srv/puppet"],
} }
selinux::manage_fcontext { "/srv/puppet/(bucket|reports|rrd)(/.*)?":
type => $seltype_writable,
before => File["/srv/puppet/reports"],
}
if $puppet_storeconfigs != "none" { if $puppet_storeconfigs != "none" {
file { "/srv/puppet/storeconfigs": file { "/srv/puppet/storeconfigs":
@ -331,7 +341,7 @@ class puppet::server::common inherits puppet::client {
mode => "0750", mode => "0750",
owner => $user, owner => $user,
group => $group, group => $group,
seltype => $seltype, seltype => $seltype_readonly,
require => File["/srv/puppet"], require => File["/srv/puppet"],
} }
} }
@ -342,7 +352,7 @@ class puppet::server::common inherits puppet::client {
mode => "0750", mode => "0750",
owner => $user, owner => $user,
group => $group, group => $group,
seltype => $seltype, seltype => $seltype_writable,
require => File["/srv/puppet"], require => File["/srv/puppet"],
} }
file { [ "/srv/puppet/files", file { [ "/srv/puppet/files",
@ -354,7 +364,7 @@ class puppet::server::common inherits puppet::client {
"openbsd" => "wheel", "openbsd" => "wheel",
default => "root", default => "root",
}, },
seltype => $seltype, seltype => $seltype_readonly,
require => File["/srv/puppet"], require => File["/srv/puppet"],
} }
file { "/srv/puppet/files/common": file { "/srv/puppet/files/common":
@ -365,7 +375,7 @@ class puppet::server::common inherits puppet::client {
"openbsd" => "wheel", "openbsd" => "wheel",
default => "root", default => "root",
}, },
seltype => $seltype, seltype => $seltype_readonly,
require => File["/srv/puppet/files"], require => File["/srv/puppet/files"],
} }
file { "/srv/puppet/files/private": file { "/srv/puppet/files/private":
@ -373,7 +383,7 @@ class puppet::server::common inherits puppet::client {
mode => "0750", mode => "0750",
owner => "root", owner => "root",
group => $group, group => $group,
seltype => $seltype, seltype => $seltype_readonly,
require => File["/srv/puppet/files"], require => File["/srv/puppet/files"],
} }