Feature: Make selboolean management optional

theforeman · Jun 3, 2020 · 957fc61 · 957fc61
1 parent 2dc5e7d
commit 957fc61
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/manifests/config.pp b/manifests/config.pp
@@ -138,6 +138,7 @@
       keycloak                => $foreman::keycloak,
       keycloak_app_name       => $foreman::keycloak_app_name,
       keycloak_realm          => $foreman::keycloak_realm,
+      manage_selinux          => $foreman::manage_selinux,
     }
 
     contain foreman::config::apache

diff --git a/manifests/config/apache.pp b/manifests/config/apache.pp
@@ -98,6 +98,9 @@
 # @param keycloak_realm
 #   The realm as passed to keycloak-httpd-client-install
 #
+# @param manage_selinux
+#   If true AND selinux is enabled on the node, set httpd_can_network_connect so apache works properly
+#
 class foreman::config::apache(
   Stdlib::Absolutepath $app_root = '/usr/share/foreman',
   String $priority = '05',
@@ -131,6 +134,7 @@
   Boolean $keycloak = false,
   String[1] $keycloak_app_name = 'foreman-openidc',
   String[1] $keycloak_realm = 'ssl-realm',
+  Boolean $manage_selinux = true,
 ) {
   $docroot = "${app_root}/public"
 
@@ -222,7 +226,7 @@
       ],
     }
 
-    if $facts['os']['selinux']['enabled'] {
+    if $facts['os']['selinux']['enabled'] and $manage_selinux {
       selboolean { 'httpd_can_network_connect':
         persistent => true,
         value      => 'on',

diff --git a/manifests/init.pp b/manifests/init.pp
@@ -198,6 +198,8 @@
 #
 # $rails_cache_store::            Set rails cache store
 #
+# $param manage_selinux:          If true AND selinux is enabled on the node, set httpd_can_network_connect so apache works properly##
+#
 # === Keycloak parameters:
 #
 # $keycloak::                     Enable Keycloak support. Note this is limited
@@ -207,7 +209,6 @@
 # $keycloak_app_name::            The app name as passed to keycloak-httpd-client-install
 #
 # $keycloak_realm::               The realm as passed to keycloak-httpd-client-install
-#
 class foreman (
   Stdlib::HTTPUrl $foreman_url = $foreman::params::foreman_url,
   Boolean $unattended = $foreman::params::unattended,
@@ -307,6 +308,7 @@
   Boolean $keycloak = $foreman::params::keycloak,
   String[1] $keycloak_app_name = $foreman::params::keycloak_app_name,
   String[1] $keycloak_realm = $foreman::params::keycloak_realm,
+  Boolean $manage_selinux = false,
 ) inherits foreman::params {
   if $db_sslmode == 'UNSET' and $db_root_cert {
     $db_sslmode_real = 'verify-full'