Add selinux changes for cockpit

[carbonin]

This allows the cockpit proxy to work while also allowing
us to access the cockpit webconsole for the appliance.

37502e8 removed the previous implementation
but that breaks to cockpit VM console (cockpit_ws) role

This was the original implementation in #130, but was rejected for being needlessly complex. Now we seem to need that complexity to simultaneously proxy cockpit connections and run cockpit on the appliance itself. That didn't work.

This was created by the following process:

• set selinux to permissive
• enable the cockpit role
• Request a cockpit webconsole to a VM
• audit2allow -a -m cockpit_ws_miq > cockpit_ws_miq.te

https://bugzilla.redhat.com/show_bug.cgi?id=1779988

[carbonin]

Looks like this isn't good enough, but after fixing the UI I was able to get this running with setenforce 0 so I'll try to figure out an alternative.

[carbonin]

With this and ManageIQ/manageiq-ui-classic#6522 I was able to get both a webconsole to a remote VM and access cockpit for the appliance running manageiq.

[carbonin]

Moving this to WIP while I try to minimize the changes.

[miq-bot]

Some comments on commits carbonin/manageiq-appliance@afe24fb~...e426901

manageiq-setup.sh

• ⚠️ - 54 - Detected pp. Remove all debugging statements.
• ⚠️ - 55 - Detected pp. Remove all debugging statements.

[miq-bot]

Checked commits carbonin/manageiq-appliance@afe24fb~...e426901 with ruby 2.5.5, rubocop 0.69.0, haml-lint 0.20.0, and yamllint 1.10.0
0 files checked, 0 offenses detected
Everything looks fine. ⭐

[carbonin]

Minimized the selinux changes and moved the auth script to this repo.

These changes require ManageIQ/manageiq#19631

[jrafanie]

This is clearly better than it was after you reduced the scope of the needed selinux permission changes. 👍

[simaishi]

Ivanchuk backport details:

$ git log -1
commit b915ed726529e28a4e1f25fa7def9b4ba56fab5c
Author: Joe Rafaniello <jrafanie@users.noreply.github.com>
Date:   Wed Dec 11 17:18:04 2019 -0500

    Merge pull request #266 from carbonin/readd_selinux_changes_for_cockpit

    Add selinux changes for cockpit

    (cherry picked from commit 2d4ef11e7144313970cd1a1f97ffd80eed409d49)

    Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1784555