confdroid_nagios/manifests/selinux/config.pp

## cd_nagios::selinux::config.pp
# Module name: cd_nagios
# Author: Arne Teuke (arne_teuke@ConfDroid.com)
# # License:
#    This file is part of cd_nagios.
#
#    cd_nagios is used for providing automatic configuration of Nagios
#    Copyright (C) 2016  ConfDroid (copyright@ConfDroid.com)
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
# @summary  Class manages all aspects of configuring the module logic for
#   cd_nagios.
##############################################################################
class cd_nagios::selinux::config (

) inherits cd_nagios::params {

  if $ng_use_selinux_tools == true {

  # it appears that selinux hehaves differently accross different nodes,
  # so all we can do for now is to create a list of the AVC alerts and come up
  # with a solution on that later.

    exec { 'create_avc_list':
      command     =>  'sealert -a /var/log/audit/audit.log > avc_alerts',
      cwd         =>  $ng_user_home,
      path        =>  ['/usr/bin'],
      creates     =>  "${ng_user_home}/avc_alerts",
    }

    # sealert tac-cgi
    exec { 'create_policy_taccgi':
      command     =>  template($ng_taccgi_erb),
      path        =>  ['/usr/bin','/usr/sbin'],
      cwd         =>  $ng_user_home,
      creates     =>  "${ng_user_home}/my-taccgi.pp",
      notify      =>  Exec['semodule_taccgi'],
    }

    exec { 'semodule_taccgi':
      command     =>  'semodule -i my-taccgi.pp',
      path        =>  ['/usr/bin','/usr/sbin'],
      cwd         =>  $ng_user_home,
      require     =>  Exec['create_policy_taccgi'],
      refreshonly =>  true,
    }

    # sealert status.cgi

    exec { 'create_policy_statuscgi':
      command     =>  template($ng_statcgi_erb),
      path        =>  ['/usr/bin','/usr/sbin'],
      cwd         =>  $ng_user_home,
      creates     =>  "${ng_user_home}/my-statuscgi.pp",
      notify      =>  Exec['semodule_statuscgi'],
    }

    exec { 'semodule_statuscgi':
      command     =>  'semodule -i my-statuscgi.pp',
      path        =>  ['/usr/bin','/usr/sbin'],
      cwd         =>  $ng_user_home,
      require     =>  Exec['create_policy_statuscgi'],
      refreshonly =>  true,
      notify      =>  Service[$ng_service],
    }
  }
}