From 957fc613dbf57998a535295ce89b68a6ecc7fc2d Mon Sep 17 00:00:00 2001
From: Tim Meusel <tim@bastelfreak.de>
Date: Wed, 3 Jun 2020 11:24:03 +0200
Subject: [PATCH] Feature: Make selboolean management optional

---
 manifests/config.pp        | 1 +
 manifests/config/apache.pp | 6 +++++-
 manifests/init.pp          | 4 +++-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/manifests/config.pp b/manifests/config.pp
index 845773d16..cd9040a0b 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -138,6 +138,7 @@
       keycloak                => $foreman::keycloak,
       keycloak_app_name       => $foreman::keycloak_app_name,
       keycloak_realm          => $foreman::keycloak_realm,
+      manage_selinux          => $foreman::manage_selinux,
     }
 
     contain foreman::config::apache
diff --git a/manifests/config/apache.pp b/manifests/config/apache.pp
index f103d51b2..7853d3cff 100644
--- a/manifests/config/apache.pp
+++ b/manifests/config/apache.pp
@@ -98,6 +98,9 @@
 # @param keycloak_realm
 #   The realm as passed to keycloak-httpd-client-install
 #
+# @param manage_selinux
+#   If true AND selinux is enabled on the node, set httpd_can_network_connect so apache works properly
+#
 class foreman::config::apache(
   Stdlib::Absolutepath $app_root = '/usr/share/foreman',
   String $priority = '05',
@@ -131,6 +134,7 @@
   Boolean $keycloak = false,
   String[1] $keycloak_app_name = 'foreman-openidc',
   String[1] $keycloak_realm = 'ssl-realm',
+  Boolean $manage_selinux = true,
 ) {
   $docroot = "${app_root}/public"
 
@@ -222,7 +226,7 @@
       ],
     }
 
-    if $facts['os']['selinux']['enabled'] {
+    if $facts['os']['selinux']['enabled'] and $manage_selinux {
       selboolean { 'httpd_can_network_connect':
         persistent => true,
         value      => 'on',
diff --git a/manifests/init.pp b/manifests/init.pp
index 2d7a9f568..0661f0d68 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -198,6 +198,8 @@
 #
 # $rails_cache_store::            Set rails cache store
 #
+# $param manage_selinux:          If true AND selinux is enabled on the node, set httpd_can_network_connect so apache works properly##
+#
 # === Keycloak parameters:
 #
 # $keycloak::                     Enable Keycloak support. Note this is limited
@@ -207,7 +209,6 @@
 # $keycloak_app_name::            The app name as passed to keycloak-httpd-client-install
 #
 # $keycloak_realm::               The realm as passed to keycloak-httpd-client-install
-#
 class foreman (
   Stdlib::HTTPUrl $foreman_url = $foreman::params::foreman_url,
   Boolean $unattended = $foreman::params::unattended,
@@ -307,6 +308,7 @@
   Boolean $keycloak = $foreman::params::keycloak,
   String[1] $keycloak_app_name = $foreman::params::keycloak_app_name,
   String[1] $keycloak_realm = $foreman::params::keycloak_realm,
+  Boolean $manage_selinux = false,
 ) inherits foreman::params {
   if $db_sslmode == 'UNSET' and $db_root_cert {
     $db_sslmode_real = 'verify-full'