Use the firewall role, the selinux role, and the certificate role from the logging role #293

nhosoi · 2022-09-15T21:44:51Z

Use the firewall role and the selinux role from the logging role

Introduce logging_manage_firewall to use the firewall role to manage the syslog ports. logging_manage_firewall is set to true, by default. If the variable is set to false, the firewall configuration is disabled.
Introduce logging_manage_selinux to use the selinux role to manage the ports specified in the logging configuration. logging_manage_selinux is set to true, by default. If the variable is set to false, the selinux configuration is disabled except the ports defined in the selinux policy.
Add the test check task check_firewall_selinux.yml for verify the ports status.
Add meta/collection-requirements.yml

Use the certificate role to generate certificates in the logging role

Introduce logging_certificates variable to specify parameters for using the certificate role.

Note: This pr is for refactoring #292.

nhosoi · 2022-09-15T22:45:34Z

[citest]

nhosoi · 2022-09-16T17:16:26Z

tasks/gather_ports.yml

+      {%-  endif %}
+      {% endfor %}
+      {% set both = [tcp_ports, tls_tcp_ports] %}
+      {{ both }}


Sadly, this does not work for ansible-2.9. :( Fixing it now.

what is the issue?

Ansible 2.9 requires strict list filter to convert string to list... (ansible-core-2.13 quietly interprets it for me, and I did not notice it... :p)

(but i only tested a couple of test playbooks... there could be more issues...)

richm · 2022-09-16T21:09:08Z

Yes - and it is difficult to test this locally e.g. you can't install ansible 2.9 with jinja 2.7 in a virtualenv with fedora anymore

nhosoi · 2022-09-18T20:05:16Z

[citest]

nhosoi · 2022-09-19T05:22:16Z

[citest]

nhosoi · 2022-09-20T03:59:19Z

[citest bad]

- Introduce logging_manage_firewall to use the firewall role to manage the syslog ports. logging_manage_firewall is set to true, by default. If the variable is set to false, the firewall configuration is disabled. - Introduce logging_manage_selinux to use the selinux role to manage the ports specified in the logging configuration. logging_manage_ selinux is set to true, by default. If the variable is set to false, the selinux configuration is disabled except the ports defined in the selinux policy. - Add the test check task check_firewall_selinux.yml for verify the ports status. - Add meta/collection-requirements.yml Use the certificate role to generate certificates in the logging role - Introduce logging_certificates variable to specify parameters for using the certificate role.

nhosoi · 2022-09-20T05:31:31Z

[citest]

set to false, it does not call the firewall role and the selinux role, respectively. The default value of logging_manage_firewall and logging_ manage_selinux are changed to false.

richm · 2022-09-22T18:20:40Z

README.md

+  NOTE: `logging_manage_firewall` is limited to *adding* ports.
+  It cannot be used for *removing* ports.
+  If you want to remove ports, you will need to use the firewall system
+  roles directly.


Suggested change

roles directly.

role directly.

richm · 2022-09-22T18:20:50Z

README.md

+  NOTE: `logging_manage_selinux` is limited to *adding* policy.
+  It cannot be used for *removing* policy.
+  If you want to remove policy, you will need to use the selinux system
+  roles directly.


Suggested change

roles directly.

role directly.

richm · 2022-09-22T18:21:29Z

README.md

+
+The port is then configured by the selinux role and given
+an appropriate syslog selinux port type depending upon the
+associated tls value.


Some inputs/outputs (e.g., relp) have a tls key in the dictionary like this.

- `tls`: If true, encrypt the connection with TLS. You must provide key/certificates and triplets {`ca_cert`, `cert`, `private_key`} and/or {`ca_cert_src`, `cert_src`, `private_key_src`}. Default to `true`.

I'm going to put ` around tls as follows. Do you think it's clearer?

859 associated tls value.

ah, I see - then use TLS in all caps.

richm · 2022-09-22T18:24:20Z

tasks/firewall.yml

+---
+- block:
+    - name: Add tcp ports to logging_firewall_ports
+      set_fact:


Since you are using set_fact, you'll need to ensure that logging_firewall_ports is empty before this task, either by resetting it before this task, or resetting it after the task that calls the firewall role

nhosoi · 2022-09-22T21:51:54Z

[citest]

richm · 2022-09-23T18:42:03Z

[citest]

richm · 2022-09-26T18:19:25Z

README.md

+
+Otherwise, please run the following command line to install the collection.
+```
+ansible-galaxy collection install -r meta/requirements.yml


Suggested change

ansible-galaxy collection install -r meta/requirements.yml

ansible-galaxy collection install -r meta/collection-requirements.yml

richm · 2022-09-26T19:04:47Z

[citest]

nhosoi · 2022-09-27T17:21:32Z

[citest bad]

[1.11.0] - 2022-11-01 -------------------- ### New Features - Use the firewall role, the selinux role, and the certificate role from the logging role (linux-system-roles#293) - Introduce logging_manage_firewall to use the firewall role to manage the syslog ports. logging_manage_firewall is set to true, by default. If the variable is set to false, the firewall configuration is disabled. - Introduce logging_manage_selinux to use the selinux role to manage the ports specified in the logging configuration. logging_manage_ selinux is set to true, by default. If the variable is set to false, the selinux configuration is disabled except the ports defined in the selinux policy. - Add the test check task check_firewall_selinux.yml for verify the ports status. - Use the certificate role to generate certificates in the logging role - Introduce logging_certificates variable to specify parameters for using the certificate role. When logging_manage_firewall and logging_manage_selinux are set to false, it does not call the firewall role and the selinux role, respectively. The default value of logging_manage_firewall and logging_ manage_selinux are changed to false. ### Bug Fixes - none ### Other Changes - To avoid the CI conflicts on the control host when running tests in parallel, create a temporary directory by tempfile to store files used in the test. Signed-off-by: Rich Megginson <rmeggins@redhat.com>

[1.11.0] - 2022-11-01 -------------------- ### New Features - Use the firewall role, the selinux role, and the certificate role from the logging role (#293) - Introduce logging_manage_firewall to use the firewall role to manage the syslog ports. logging_manage_firewall is set to true, by default. If the variable is set to false, the firewall configuration is disabled. - Introduce logging_manage_selinux to use the selinux role to manage the ports specified in the logging configuration. logging_manage_ selinux is set to true, by default. If the variable is set to false, the selinux configuration is disabled except the ports defined in the selinux policy. - Add the test check task check_firewall_selinux.yml for verify the ports status. - Use the certificate role to generate certificates in the logging role - Introduce logging_certificates variable to specify parameters for using the certificate role. When logging_manage_firewall and logging_manage_selinux are set to false, it does not call the firewall role and the selinux role, respectively. The default value of logging_manage_firewall and logging_ manage_selinux are changed to false. ### Bug Fixes - none ### Other Changes - To avoid the CI conflicts on the control host when running tests in parallel, create a temporary directory by tempfile to store files used in the test. Signed-off-by: Rich Megginson <rmeggins@redhat.com> Signed-off-by: Rich Megginson <rmeggins@redhat.com>

nhosoi force-pushed the use_roles branch from 8d186f8 to 89487e9 Compare September 15, 2022 22:02

nhosoi commented Sep 16, 2022

View reviewed changes

nhosoi force-pushed the use_roles branch from 12926d3 to 6e9ad94 Compare September 20, 2022 05:27

When logging_manage_firewall and logging_manage_selinux are

2d72616

set to false, it does not call the firewall role and the selinux role, respectively. The default value of logging_manage_firewall and logging_ manage_selinux are changed to false.

nhosoi force-pushed the use_roles branch from cad0f5f to 2d72616 Compare September 22, 2022 00:10

nhosoi mentioned this pull request Sep 22, 2022

Use the firewall role and the selinux role to manage the ports; use the certificate role to generate certificates. #292

Closed

richm reviewed Sep 22, 2022

View reviewed changes

Fixed issues found in the reviews by @richm.

b215d63

nhosoi force-pushed the use_roles branch 2 times, most recently from dd1ab93 to 160c2f3 Compare September 26, 2022 17:49

richm reviewed Sep 26, 2022

View reviewed changes

Updated the requirements section for fedora.linux_system_roles.

2345f7a

nhosoi force-pushed the use_roles branch from 160c2f3 to 2345f7a Compare September 26, 2022 18:30

richm mentioned this pull request Sep 27, 2022

Automatically handle SELinux for port customization linux-system-roles/cockpit#73

Closed

richm approved these changes Sep 27, 2022

View reviewed changes

richm merged commit 6cfbd22 into linux-system-roles:master Sep 27, 2022

richm mentioned this pull request Nov 1, 2022

Version 1.11.0 - CHANGELOG.md [citest skip] #296

Merged

richm mentioned this pull request Nov 9, 2022

Add certificate testing linux-system-roles/postgresql#5

Merged

nhosoi deleted the use_roles branch February 11, 2023 00:18

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use the firewall role, the selinux role, and the certificate role from the logging role #293

Use the firewall role, the selinux role, and the certificate role from the logging role #293

nhosoi commented Sep 15, 2022

nhosoi commented Sep 15, 2022

nhosoi Sep 16, 2022 •

edited

richm Sep 16, 2022

nhosoi Sep 16, 2022 •

edited

richm commented Sep 16, 2022

nhosoi commented Sep 18, 2022

nhosoi commented Sep 19, 2022

nhosoi commented Sep 20, 2022

nhosoi commented Sep 20, 2022

richm Sep 22, 2022

richm Sep 22, 2022

richm Sep 22, 2022

nhosoi Sep 22, 2022

richm Sep 22, 2022

richm Sep 22, 2022

nhosoi commented Sep 22, 2022

richm commented Sep 23, 2022

richm Sep 26, 2022

richm commented Sep 26, 2022

nhosoi commented Sep 27, 2022

	ansible-galaxy collection install -r meta/requirements.yml
	ansible-galaxy collection install -r meta/collection-requirements.yml

Use the firewall role, the selinux role, and the certificate role from the logging role #293

Use the firewall role, the selinux role, and the certificate role from the logging role #293

Conversation

nhosoi commented Sep 15, 2022

nhosoi commented Sep 15, 2022

nhosoi Sep 16, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nhosoi Sep 16, 2022 • edited

Choose a reason for hiding this comment

richm commented Sep 16, 2022

nhosoi commented Sep 18, 2022

nhosoi commented Sep 19, 2022

nhosoi commented Sep 20, 2022

nhosoi commented Sep 20, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nhosoi commented Sep 22, 2022

richm commented Sep 23, 2022

Choose a reason for hiding this comment

richm commented Sep 26, 2022

nhosoi commented Sep 27, 2022

nhosoi Sep 16, 2022 •

edited

nhosoi Sep 16, 2022 •

edited