openstack/puppet-tripleo
Code Issues Proposed changes

Merge "Remove puppet selinux management"

Browse Source
This commit is contained in:
Zuul 2019-04-25 16:16:04 +00:00 committed by Gerrit Code Review
commit 287b28431a
2 changed files with 0 additions and 147 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
manifests/selinux.pp
View File

@ -1,74 +0,0 @@
#
# Copyright (C) 2014 eNovance SAS <licensing@enovance.com>
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# == Class: tripleo::selinux
#
# Helper class to configure SELinux on nodes
#
# === Parameters:
#
# [*mode*]
# (optional) SELinux mode the system should be in
# Defaults to 'enforcing'
# Possible values : disabled, permissive, enforcing
#
# [*directory*]
# (optional) Path where to find the SELinux modules
# Defaults to '/usr/share/selinux'
#
# [*booleans*]
# (optional) Set of booleans to persistently enables
# SELinux booleans are the one getsebool -a returns
# Defaults []
# Example: ['rsync_full_access', 'haproxy_connect_any']
#
# [*modules*]
# (optional) Set of modules to load on the system
# Defaults []
# Example: ['module1', 'module2']
# Note: Those module should be in the $directory path
#
class tripleo::selinux (
$directory = '/usr/share/selinux/',
$booleans = [],
$modules = [],
# Deprecated
$mode = undef,
) {
if $mode {
warning('The "mode" parameter is deprecated.')
}
if $::osfamily != 'RedHat' {
fail("OS family unsuppored yet (${::osfamily}), SELinux support is only limited to RedHat family OS")
}
Selboolean {
persistent => true,
value => 'on',
}
Selmodule {
ensure => present,
selmoduledir => $directory,
}
selboolean { $booleans :
persistent => true,
}
selmodule { $modules: }
}

73
spec/classes/tripleo_selinux_spec.rb
View File

@ -1,73 +0,0 @@
# Copyright (C) 2014 eNovance SAS <licensing@enovance.com>
#
# Licensed under the Apache License, Version 2.0 (the "License"); you may
# not use this file except in compliance with the License. You may obtain
# a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# Unit tests for tripleo::selinux
#
require 'spec_helper'
describe 'tripleo::selinux' do
shared_examples_for 'tripleo::selinux' do
context 'sebool and semodule management' do
before :each do
facts.merge!({
:selinux => true,
:selinux_current_mode => 'enforcing'
})
end
let :params do
{ :booleans => ['foo', 'bar'],
:modules => ['module1', 'module2'],
:directory => '/path/to/modules'}
end
it 'enables the SELinux boolean' do
is_expected.to contain_selboolean('foo').with(
:persistent => true,
:value => 'on',
)
end
it 'enables the SELinux modules' do
is_expected.to contain_selmodule('module1').with(
:ensure => 'present',
:selmoduledir => '/path/to/modules',
)
end
end
end
context 'on Debian platforms' do
let :facts do
{ :osfamily => 'Debian' }
end
it_raises 'a Puppet::Error', /OS family unsuppored yet \(Debian\), SELinux support is only limited to RedHat family OS/
end
on_supported_os.each do |os, facts|
context "on #{os}" do
let(:facts) do
facts.merge({})
end
it_behaves_like 'tripleo::selinux'
end
end
end