confdroid_nagios/manifests/selinux/config.pp

## cd_nagios::selinux::config.pp
# Module name: cd_nagios
# Author: Arne Teuke (arne_teuke@ConfDroid.com)
# @summary  Class manages all aspects of selinux for cd_nagios.
##############################################################################
class cd_nagios::selinux::config (

) inherits cd_nagios::params {
  if $ng_use_selinux_tools == true {
    require cd_selinux

    # it appears that selinux behaves differently across different nodes,
    # so all we can do for now is to create a list of the AVC alerts and come up
    # with a solution on that later.

    exec { 'create_avc_list':
      command => 'sealert -a /var/log/audit/audit.log > avc_alerts',
      cwd     => $ng_user_home,
      path    => ['/usr/bin'],
      creates => "${ng_user_home}/avc_alerts",
    }

    # sealert tac-cgi
#    exec { 'create_policy_taccgi':
#      command    => template($ng_taccgi_erb),
#      path       => ['/usr/bin','/usr/sbin'],
#      user       => $ng_user,
#      cwd        => $ng_user_home,
#      creates    => "${ng_user_home}/my-taccgi.pp",
#      notify     => Exec['semodule_taccgi'],
#    }

#    exec { 'semodule_taccgi':
#      command    => "semodule -i ${ng_user_home}/my-taccgi.pp",
#      path       => ['/usr/bin','/usr/sbin'],
#      user       => $ng_user,
#      cwd        => $ng_user_home,
#      require    => Exec['create_policy_taccgi'],
#      refreshonly => true,
#    }

    # sealert status.cgi

#    exec { 'create_policy_statuscgi':
#      command    => template($ng_statcgi_erb),
#      path       => ['/usr/bin','/usr/sbin'],
#      cwd        => $ng_user_home,
#      creates    => "${ng_user_home}/my-statuscgi.pp",
#      notify     => Exec['semodule_statuscgi'],
#    }

#    exec { 'semodule_statuscgi':
#      command    => 'semodule -i my-statuscgi.pp',
#      path       => ['/usr/bin','/usr/sbin'],
#      cwd        => $ng_user_home,
#      require    => Exec['create_policy_statuscgi'],
#      refreshonly => true,
#      notify     => Service[$ng_service],
#    }

    # sealert check_nrpe

#    exec { 'create_policy_checknrpe':
#      command    => template($ng_checknrpe_erb),
#      path       => ['/usr/bin','/usr/sbin'],
#      cwd        => $ng_user_home,
#      creates    => "${ng_user_home}/my-checknrpe.pp",
#      notify     => Exec['semodule_checknrpe'],
#    }

#    exec { 'semodule_checknrpe':
#      command    => 'semodule -i my-checknrpe.pp',
#      path       => ['/usr/bin','/usr/sbin'],
#      cwd        => $ng_user_home,
#      require    => Exec['create_policy_checknrpe'],
#      refreshonly => true,
#      notify     => Service[$ng_service],
#    }

    # sealert check_nagios

#    exec { 'create_policy_checknagios':
#      command    => template($ng_checknagios_erb),
#      path       => ['/usr/bin','/usr/sbin'],
#      cwd        => $ng_user_home,
#      creates    => "${ng_user_home}/my-checknagios.pp",
#      notify     => Exec['semodule_checknagios'],
#    }

#    exec { 'semodule_checknagios':
#      command    => 'semodule -i my-checknagios.pp',
#      path       => ['/usr/bin','/usr/sbin'],
#      cwd        => $ng_user_home,
#      require    => Exec['create_policy_checknagios'],
#      refreshonly => true,
#      notify     => Service[$ng_service],
#    }

    # sealert status.dat

    exec { 'create_policy_statusdat':
      command => template($ng_statdat_erb),
      path    => ['/usr/bin','/usr/sbin'],
      user    => $ng_user,
      cwd     => $ng_user_home,
      creates => "${ng_user_home}/my-http.pp",
      notify  => Exec['semodule_statusdat'],
    }

    exec { 'semodule_statusdat':
      command     => "semodule -i ${ng_user_home}/my-httpd.pp",
      path        => ['/usr/bin','/usr/sbin'],
      user        => $ng_user,
      cwd         => $ng_user_home,
      require     => Exec['create_policy_statusdat'],
      refreshonly => true,
      notify      => Service[$ng_service],
    }

    # sealert grep

    exec { 'create_policy_grep':
      command => template($ng_grep_erb),
      path    => ['/usr/bin','/usr/sbin'],
      user    => $ng_user,
      cwd     => $ng_user_home,
      creates => "${ng_user_home}/my-grep.pp",
      notify  => Exec['semodule_statusdat'],
    }

    exec { 'semodule_grep':
      command     => "semodule -i ${ng_user_home}/my-grep.pp",
      path        => ['/usr/bin','/usr/sbin'],
      user        => $ng_user,
      cwd         => $ng_user_home,
      require     => Exec['create_policy_grep'],
      refreshonly => true,
      notify      => Service[$ng_service],
    }
  }
}