Problem with undef from left operand of 'in' at module.pp:38

[salderma]

Hi, I am using your module from puppetforge to deploy a simple selinux policy.te file to many nodes like so:

  selinux::module { 'puppetlocal':
    ensure => present,
    source => 'puppet:///modules/site/selinux/puppetlocal.te',
  }

All agents where this is applied fail with:

'undef' from left of operand of 'in' expression is not a string at <modulepath>/selinux/manifests/module.pp:38

I am not using any references or resources from your module anywhere else for these nodes manifests. I am not following why there needs to be a global param defined to set the selinux policy. Shouldn't this be a module param? Can you provide any advice?

Thanks!

[salderma]

Also it seems some times my systems have this in their puppet reports, and selinux is completely disabled...

(/Stage[main]/Selinux::Config/File_line[set-selinux-config-to-disabled]/ensure) created

Which is a nasty side effect.

[mikalsande]

I am facing the same problem. This module configures disables SELinux by default, setting SELINUX=disabled in /etc/selinux/config. Then after reboot SELinux will be disabled and puppet will fail with this error:

"Error: Could not retrieve catalog from remote server: Error 400 on SERVER: 'undef' from left operand of 'in' expression is not a string at /etc/puppet/modules/selinux/manifests/module.pp:38 on node"

[mikalsande]

@salderma This problem seemes to be fixed in the 0.2.6 release.

Spoke too soon. This module will still not run when SELinux is disabled. puppet agent stops with the same error as above. My guess is that this error is is because the module does not handle SELinux being disabled.

[salderma]

@mikalsande you are correct. I guess I'm just going to break it down and hardcode the params.pp to enforcing like you suggested in another issue.

[mikalsande]

It seems there was a bug related to this #64

[purplexa]

The problem here seems to be the use of $::selinux_config_policy, which doesn't exist. It's not clear to me what that code is supposed to do.

[vinzent]

this should be addressd in the current version.

if you still see this problem, please re-open the issue.