From ff50d443546ed3f9a2a4b5bb036ea76ee80aecaa Mon Sep 17 00:00:00 2001
From: Tim Meusel <tim@bastelfreak.de>
Date: Wed, 3 Jun 2020 11:24:03 +0200
Subject: [PATCH] Feature: Make selboolean management optional

---
 manifests/config.pp        | 1 +
 manifests/config/apache.pp | 6 +++++-
 manifests/init.pp          | 3 +++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/manifests/config.pp b/manifests/config.pp
index 845773d16..00408520e 100644
--- a/manifests/config.pp
+++ b/manifests/config.pp
@@ -138,6 +138,7 @@
       keycloak                => $foreman::keycloak,
       keycloak_app_name       => $foreman::keycloak_app_name,
       keycloak_realm          => $foreman::keycloak_realm,
+      manage_selinux_booleans => $foreman::manage_selinux_booleans,
     }
 
     contain foreman::config::apache
diff --git a/manifests/config/apache.pp b/manifests/config/apache.pp
index f103d51b2..5e792799a 100644
--- a/manifests/config/apache.pp
+++ b/manifests/config/apache.pp
@@ -98,6 +98,9 @@
 # @param keycloak_realm
 #   The realm as passed to keycloak-httpd-client-install
 #
+# @param manage_selinux_booleans
+#   If true AND selinux is enabled on the node, set httpd_can_network_connect so apache works properly
+#
 class foreman::config::apache(
   Stdlib::Absolutepath $app_root = '/usr/share/foreman',
   String $priority = '05',
@@ -131,6 +134,7 @@
   Boolean $keycloak = false,
   String[1] $keycloak_app_name = 'foreman-openidc',
   String[1] $keycloak_realm = 'ssl-realm',
+  Boolean $manage_selinux_booleans = true,
 ) {
   $docroot = "${app_root}/public"
 
@@ -222,7 +226,7 @@
       ],
     }
 
-    if $facts['os']['selinux']['enabled'] {
+    if $facts['os']['selinux']['enabled'] and $manage_selinux_booleans {
       selboolean { 'httpd_can_network_connect':
         persistent => true,
         value      => 'on',
diff --git a/manifests/init.pp b/manifests/init.pp
index 2d7a9f568..dbec16819 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -198,6 +198,8 @@
 #
 # $rails_cache_store::            Set rails cache store
 #
+# $manage_selinux_booleans::      If true AND selinux is enabled on the node, set httpd_can_network_connect so apache works properly##
+#
 # === Keycloak parameters:
 #
 # $keycloak::                     Enable Keycloak support. Note this is limited
@@ -307,6 +309,7 @@
   Boolean $keycloak = $foreman::params::keycloak,
   String[1] $keycloak_app_name = $foreman::params::keycloak_app_name,
   String[1] $keycloak_realm = $foreman::params::keycloak_realm,
+  Boolean $manage_selinux_booleans = false,
 ) inherits foreman::params {
   if $db_sslmode == 'UNSET' and $db_root_cert {
     $db_sslmode_real = 'verify-full'