install icinga2-selinux #602
Conversation
| exec { '/usr/sbin/restorecon -R -F /var/lib/icinga2': | ||
| refreshonly => true | ||
| } | ||
| } |
There was a problem hiding this comment.
Two things I have in mind here:
- Limit this to osfamily - redhat
- Why the manual restorecon exec?
There was a problem hiding this comment.
Limit to RedHat family isn't needed. SELinux is included since kernel 2.6 and not limited to RedHat systems. But of course the icinga project only distributes packages for RedHat family. Maybe this will change in the future.
We switched to module data in puppet-icinga2 v2.0 so you're able to use your own configured package. In this case it's important that the default fit to the operating system or is set to false.
There was a problem hiding this comment.
Since there is no package icinga2-selinux on distributions other than RHEL, I'd opt for the osfamily as otherwise the manifest will fail on Debian and alike. Even if you manage all that with a boolean up front.
There was a problem hiding this comment.
Default to false to all platforms (include Debian), the puppet run will be finished without any errors. If you set selinux to true you have to know what you're doing.
Starts with module data it isn't accepted to set such limits anymore. Because now you can extend the module with your own packages or packages for not supported platform.
|
Please explain the requirement of: exec { '/usr/sbin/restorecon -R -F /var/lib/icinga2': |
|
Sorry for not answering sooner. I originally had problems getting it to work without that exec and didn't find the time to debug where it came from. I now know that the problem actually came from using a workaround similar to the one discribed here but unfornunalty I installed icinga2-selinux before installaing icinga2, which resulted in the postinstall script of icinga2-seliunx getting triggerd at a point in time some files are still missing. This postinstall actually does a fixfiles and therefore makes this exec obsolete. Maybe there should be an Require from the icinga2-selinux rpm to the icinga2 rpm (it right now only requires the icinga2-bin)? I also added a hiera data to only install on rhel and only when selinux is actually enabled. |
Fixe issue #592