Fixes #9126 - moved Katello policy to a separate repo

foreman-selinux-disable

@@ -9,7 +9,7 @@ do
   if /usr/sbin/semodule -s $selinuxvariant -l >/dev/null; then
     # Remove all user defined ports (including the default one)
     /usr/sbin/semanage port -E | \
-      grep -E '(elasticsearch|docker)_port_t' | \
+      grep -E '(docker)_port_t' | \
       sed s/-a/-d/g | \
       /usr/sbin/semanage -S $selinuxvariant -i -
     # Unload policy

foreman-selinux-enable

@@ -13,15 +13,22 @@ trap "rm -rf '$TMP'" EXIT INT TERM
 for selinuxvariant in targeted
 do
   if /usr/sbin/semodule -s $selinuxvariant -l >/dev/null; then
+    # UPGRADE STEP for Foreman 1.8 (remove after release)
+    # If katello policy was not yet loaded and elasticsearch port is still defined,
+    # remove it (it was moved to katello policy). Katello policy will not load before
+    # we remove the port definition (because SELinux prevents that).
+    semodule -l | grep -q katello || \
+      /usr/sbin/semanage port -E | \
+      grep elasticsearch_port_t | \
+      sed s/-a/-d/g | \
+      /usr/sbin/semanage -S $selinuxvariant -i -
+
     # Load policy
     /usr/sbin/semanage module -S $selinuxvariant \
       -a /usr/share/selinux/${selinuxvariant}/foreman.pp.bz2
 
     echo "boolean -m --on httpd_setrlimit" > $TMP
 
-    /usr/sbin/semanage port -E | grep -q elasticsearch_port_t || \
-      echo "port -a -t elasticsearch_port_t -p tcp 9200-9300" >> $TMP
-
     /usr/sbin/semanage port -E | grep -q docker_port_t || \
       echo "port -a -t docker_port_t -p tcp 2375-2376" >> $TMP
 

foreman-selinux-relabel

@@ -2,7 +2,6 @@
 
 # relabel foreman
 /sbin/restorecon -ri $* /usr/share/foreman \
-  /usr/share/katello \
   /var/lib/foreman \
   /var/run/foreman \
   /run/foreman \

foreman.fc

@@ -51,7 +51,3 @@
 
 /usr/share/gems/gems/foreman-tasks-.*/bin/foreman-tasks -- gen_context(system_u:object_r:foreman_tasks_exec_t,s0)
 /opt/rh/ruby193/root/usr/share/gems/gems/foreman-tasks-.*/bin/foreman-tasks -- gen_context(system_u:object_r:foreman_tasks_exec_t,s0)
-
-# Katello plugin
-
-/usr/share/katello/script/katello-jobs -- gen_context(system_u:object_r:foreman_tasks_exec_t,s0)

foreman.te

@@ -395,36 +395,6 @@ tunable_policy(`passenger_can_connect_docker_unix',`
     ')
 ')
 
-######################################
-#
-# Elasticsearch
-#
-
-# We carry elasticsearch policy until it is delivered to RHEL6:
-# https://bugzilla.redhat.com/show_bug.cgi?id=1102119
-type elasticsearch_port_t;
-corenet_port(elasticsearch_port_t)
-
-######################################
-#
-# Foreman Katello plugin
-#
-
-# System status (ping) controller checks for service status using sysvinit scripts
-# This is temporary solution until https://bugzilla.redhat.com/show_bug.cgi?id=1105085
-# is fixed.
-init_exec_script_files(passenger_t)
-
-ifndef(`distro_rhel7', `
-    consoletype_exec(passenger_t)
-')
-
-# Katello does connect to Elasticsearch services
-allow passenger_t elasticsearch_port_t:tcp_socket name_connect;
-
-# Katello uses certs in /etc/pki/katello for websockets
-miscfiles_read_certs(websockify_t)
-
 ######################################
 #
 # Foreman Bootdisk plugin