Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document needed sebooleans for httpd/zabbix-web #481

Merged
merged 2 commits into from
Jan 29, 2018
Merged

Document needed sebooleans for httpd/zabbix-web #481

merged 2 commits into from
Jan 29, 2018

Conversation

Fabian1976
Copy link
Contributor

The web.pp missed these sebooleans:

  • httpd_can_network_connect
  • httpd_can_network_connect_db

As mentioned in issue #477

@Fabian1976 Fabian1976 mentioned this pull request Jan 23, 2018
Closed
@bastelfreak
Copy link
Member

Hi @Fabian1976, thanks for this PR. I'm not sure if we should include those sebooleans in the module. They are apache specific, not zabbix specific. It is possible, that others manage this seboolean already, but outside of the module. Maybe it is better to handle this in a profile and add a note to the readme?

@bastelfreak bastelfreak added the needs-feedback Further information is requested label Jan 29, 2018
@ekohl
Copy link
Member

ekohl commented Jan 29, 2018

I wonder if ensure_resource should be used to handle possible duplicate definitions. This is always hard and IMHO an unsolved problem.

@Fabian1976
Copy link
Contributor Author

You could also fix this in a profile. But if you include zabbix::web (which needs apache), people assume that it sets the appropiate SEbooleans (it sets 1, why not all that are needed for web to work?)

@bastelfreak
Copy link
Member

There is a small but important difference. It sets all needed sebooleans that httpd needs to talk to zabbix. It doesn't set all sebooleans that httpd need. IMO we shouldn't manage those sebooleans in the zabbix module. They should be part of httpd module or a profile.

@Fabian1976
Copy link
Contributor Author

I can live with that. I allready added it to a profile as a work around. But then i will make it permanent. Not a problem. Shall i close my PR?

@ekohl
Copy link
Member

ekohl commented Jan 29, 2018

It would be great if it's at least documented in the README.

@bastelfreak
Copy link
Member

@Fabian1976 can you remove the current changes and instead document it in the README.md?

@Fabian1976
Copy link
Contributor Author

Yes, not a problem. Will do

@Fabian1976
Copy link
Contributor Author

I updated the README

ekohl
ekohl requested changes Jan 29, 2018
View reviewed changes
README.md Outdated
@@ -169,6 +169,16 @@ node 'zabbix.example.com' {
Everything will be installed on the same server. There is also an possibility to seperate the components, please check the following wiki:
https://github.com/voxpupuli/puppet-zabbix/wiki/Multi-node-Zabbix-Server-setup

Please note that if you use apache as the frontend (which is the default) and SELinux is enabled, you need to set these SEBooleans (preferably in a profile) to allow apache to connect to the database:
```ruby
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's puppet highlighting too

README.md Outdated
Please note that if you use apache as the frontend (which is the default) and SELinux is enabled, you need to set these SEBooleans (preferably in a profile) to allow apache to connect to the database:
```ruby
if $facts['selinux'] {
selboolean { ['httpd_can_network_connect', 'httpd_can_network_connect_db']
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing a colon here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed it

@bastelfreak bastelfreak changed the title Added additional seboolean Document needed sebooleans for httpd/zabbix-web Jan 29, 2018
@bastelfreak bastelfreak added docs Improvements or additions to documentation and removed needs-feedback Further information is requested labels Jan 29, 2018
@bastelfreak bastelfreak merged commit a38dfef into voxpupuli:master Jan 29, 2018
@Fabian1976 Fabian1976 deleted the fix_missing_sebool_httpd branch April 10, 2018 10:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ekohl ekohl ekohl approved these changes

Assignees
No one assigned
Labels
docs Improvements or additions to documentation
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@Fabian1976 @bastelfreak @ekohl