openstack/tripleo-heat-templates
Code Issues Proposed changes

Ensure SELinux is permissive on Ceph OSDs

Browse Source 
Currently we build the overcloud image with selinux-permissive element
in CI. However, even in environments where selinux-permissive element is
not used, it should be ensured that SELinux is set to permissive mode on
nodes with Ceph OSD [1].

We have no nice way to manage SELinux status via Puppet at the moment,
so i'm resorting to execs, but with proper "onlyif" guards.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=1241422

Change-Id: I31bd685ad4800261fd317eef759bcfd285f2ba80
This commit is contained in:
Jiri Stransky 2015-07-13 19:11:54 +02:00
parent 0405a6b248
commit 9ab0050e6e
4 changed files with 45 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
puppet/hieradata/ceph.yaml
View File

@ -12,4 +12,6 @@ ceph_pools:
- vms
- images
ceph_classes: []
ceph_classes: []
ceph_osd_selinux_permissive: true

14
puppet/manifests/overcloud_cephstorage.pp
View File

@ -30,6 +30,20 @@ if count(hiera('ntp::servers')) > 0 {
include ::ntp
}
if str2bool(hiera('ceph_osd_selinux_permissive', true)) {
exec { 'set selinux to permissive on boot':
command => "sed -ie 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config",
onlyif => "test -f /etc/selinux/config && ! grep '^SELINUX=permissive' /etc/selinux/config",
path => ["/usr/bin", "/usr/sbin"],
}
exec { 'set selinux to permissive':
command => "setenforce 0",
onlyif => "which setenforce && getenforce | grep -i 'enforcing'",
path => ["/usr/bin", "/usr/sbin"],
} -> Class['ceph::profile::osd']
}
include ::ceph::profile::client
include ::ceph::profile::osd

14
puppet/manifests/overcloud_controller.pp
View File

@ -193,6 +193,20 @@ if hiera('step') >= 2 {
}
if str2bool(hiera('enable_ceph_storage', 'false')) {
if str2bool(hiera('ceph_osd_selinux_permissive', true)) {
exec { 'set selinux to permissive on boot':
command => "sed -ie 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config",
onlyif => "test -f /etc/selinux/config && ! grep '^SELINUX=permissive' /etc/selinux/config",
path => ["/usr/bin", "/usr/sbin"],
}
exec { 'set selinux to permissive':
command => "setenforce 0",
onlyif => "which setenforce && getenforce | grep -i 'enforcing'",
path => ["/usr/bin", "/usr/sbin"],
} -> Class['ceph::profile::osd']
}
include ::ceph::profile::client
include ::ceph::profile::osd
}

14
puppet/manifests/overcloud_controller_pacemaker.pp
View File

@ -494,6 +494,20 @@ MYSQL_HOST=localhost\n",
}
if str2bool(hiera('enable_ceph_storage', 'false')) {
if str2bool(hiera('ceph_osd_selinux_permissive', true)) {
exec { 'set selinux to permissive on boot':
command => "sed -ie 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config",
onlyif => "test -f /etc/selinux/config && ! grep '^SELINUX=permissive' /etc/selinux/config",
path => ["/usr/bin", "/usr/sbin"],
}
exec { 'set selinux to permissive':
command => "setenforce 0",
onlyif => "which setenforce && getenforce | grep -i 'enforcing'",
path => ["/usr/bin", "/usr/sbin"],
} -> Class['ceph::profile::osd']
}
include ::ceph::profile::client
include ::ceph::profile::osd
}