Only include selinux bits on rhel-based systems

The gate-config-puppet-apply test will try to run everything on a
bare-precise node, so even though this doesn't occur in production it is
being tested.

Change-Id: I13b03a7476e30cbb26dc820bb4cf5b56c4018669

modules/cgit/manifests/init.pp

@@ -29,8 +29,23 @@ class cgit(
   $behind_proxy = false,
 ) {
 
+  if $behind_proxy == true {
+    $http_port = 8080
+    $https_port = 4443
+    $daemon_port = 29418
+  }
+  else {
+    $http_port = 80
+    $https_port = 443
+    $daemon_port = 9418
+  }
+
   include apache
 
+  if ($::osfamily == 'RedHat') {
+    include cgit::selinux
+  }
+
   package { [
       'cgit',
       'git-daemon',
@@ -68,54 +83,6 @@ class cgit(
     require => User['cgit'],
   }
 
-  exec { 'restorecon -R -v /var/lib/git':
-    path        => '/sbin',
-    require     => File['/var/lib/git'],
-    subscribe   => File['/var/lib/git'],
-    refreshonly => true,
-  }
-
-  selboolean { 'httpd_enable_cgi':
-    persistent => true,
-    value      => on
-  }
-
-  package { 'policycoreutils-python':
-    ensure => present,
-  }
-
-  if $behind_proxy == true {
-    $http_port = 8080
-    $https_port = 4443
-    $daemon_port = 29418
-  }
-  else {
-    $http_port = 80
-    $https_port = 443
-    $daemon_port = 9418
-  }
-
-  exec { 'cgit_allow_http_port':
-    # If we cannot add the rule modify the existing rule.
-    onlyif      => "bash -c \'! semanage port -a -t http_port_t -p tcp ${http_port}\'",
-    command     => "semanage port -m -t http_port_t -p tcp ${http_port}",
-    path        => '/bin:/usr/sbin',
-    before      => Service['httpd'],
-    require     => Package['policycoreutils-python'],
-    subscribe   => File['/etc/httpd/conf/httpd.conf'],
-    refreshonly => true,
-  }
-
-  exec { 'cgit_allow_https_port':
-    # If we cannot add the rule modify the existing rule.
-    onlyif      => "bash -c \'! semanage port -a -t http_port_t -p tcp ${https_port}\'",
-    command     => "semanage port -m -t http_port_t -p tcp ${https_port}",
-    path        => '/bin:/usr/sbin',
-    require     => Package['policycoreutils-python'],
-    subscribe   => File['/etc/httpd/conf.d/ssl.conf'],
-    refreshonly => true,
-  }
-
   apache::vhost { $vhost_name:
     port          => $https_port,
     serveraliases => $serveraliases,

modules/cgit/manifests/selinux.pp

@@ -0,0 +1,55 @@
+# Copyright 2014 Hewlett-Packard Development Company, L.P.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+# Class: cgit::selinux
+#
+class cgit::selinux {
+  exec { 'restorecon -R -v /var/lib/git':
+    path        => '/sbin',
+    require     => File['/var/lib/git'],
+    subscribe   => File['/var/lib/git'],
+    refreshonly => true,
+  }
+
+  selboolean { 'httpd_enable_cgi':
+    persistent => true,
+    value      => on
+  }
+
+  package { 'policycoreutils-python':
+    ensure => present,
+  }
+
+  exec { 'cgit_allow_http_port':
+    # If we cannot add the rule modify the existing rule.
+    onlyif      => "bash -c \'! semanage port -a -t http_port_t -p tcp ${::cgit::http_port}\'",
+    command     => "semanage port -m -t http_port_t -p tcp ${::cgit::http_port}",
+    path        => '/bin:/usr/sbin',
+    before      => Service['httpd'],
+    require     => Package['policycoreutils-python'],
+    subscribe   => File['/etc/httpd/conf/httpd.conf'],
+    refreshonly => true,
+  }
+
+  exec { 'cgit_allow_https_port':
+    # If we cannot add the rule modify the existing rule.
+    onlyif      => "bash -c \'! semanage port -a -t http_port_t -p tcp ${::cgit::https_port}\'",
+    command     => "semanage port -m -t http_port_t -p tcp ${::cgit::https_port}",
+    path        => '/bin:/usr/sbin',
+    require     => Package['policycoreutils-python'],
+    subscribe   => File['/etc/httpd/conf.d/ssl.conf'],
+    refreshonly => true,
+  }
+}
+

modules/openstack_project/manifests/git.pp

@@ -25,9 +25,11 @@ class openstack_project::git (
     sysadmins                 => $sysadmins,
   }
 
+  if ($::osfamily == 'RedHat') {
     class { 'selinux':
       mode => 'enforcing'
     }
+  }
 
   package { 'socat':
     ensure => present,

modules/openstack_project/manifests/git_backend.pp

@@ -101,9 +101,11 @@ class openstack_project::git_backend (
     refreshonly => true,
   }
 
+  if ($::osfamily == 'RedHat') {
     class { 'selinux':
       mode => 'enforcing'
     }
+  }
 
   cron { 'mirror_repack':
     user        => 'cgit',

modules/openstack_project/manifests/pbx.pp

@@ -29,8 +29,10 @@ class openstack_project::pbx (
     iptables_rules6           => ['-m udp -p udp --dport 10000:20000 -j ACCEPT'],
   }
 
+  if ($::osfamily == 'RedHat') {
     class { 'selinux':
-    mode => 'enforcing',
+      mode => 'enforcing'
+    }
   }
 
   realize (