added main config file control

README.md

@@ -1,6 +1,6 @@
 |Repo Name| version | Build Status|
 |---|---|---|---|
-|`cd_selinux`| 0.0.0.2 | [![Build Status](https://jenkins.confdroid.com/buildStatus/icon?job=cd_selinux)](https://jenkins.confdroid.com/job/cd_selinux/)|
+|`cd_selinux`| 0.0.0.3 | [![Build Status](https://jenkins.confdroid.com/buildStatus/icon?job=cd_selinux)](https://jenkins.confdroid.com/job/cd_selinux/)|
 
 ### Synopsis
 [Security-Enhanced Linux (SELinux) is a Linux kernel security module that provides a mechanism for supporting access control security policies.](https://en.wikipedia.org/wiki/Security-Enhanced_Linux)

manifests/main/config.pp

@@ -25,6 +25,6 @@ class cd_selinux::main::config (
 
 ) inherits cd_selinux::params {
 
-  include cd_selinux::main::dirs
+  include cd_selinux::main::files
 
 }

manifests/main/files.pp

@@ -0,0 +1,41 @@
+## cd_selinux::main::files.pp
+# Module name: cd_selinux
+# Author: Arne Teuke (arne_teuke@ConfDroid.com)
+# # License:
+#    This file is part of cd_selinux.
+#
+#    cd_selinux is used for providing automatic configuration of SELINUX
+#    Copyright (C) 2016  ConfDroid (copyright@ConfDroid.com)
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License as published by
+#    the Free Software Foundation, either version 3 of the License, or
+#    (at your option) any later version.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+# @summary  Class manages all configuration files required for cd_selinux.
+##############################################################################
+class cd_selinux::main::files (
+
+) inherits cd_selinux::params {
+
+  require cd_selinux::main::dirs
+
+  file { $sx_main_file:
+    ensure    =>  file,
+    path      =>  $sx_main_file,
+    owner     =>  'root',
+    group     =>  'root',
+    mode      =>  '0644',
+    selrange  =>  s0,
+    selrole   =>  object_r,
+    seltype   =>  selinux_config_t,
+    seluser   =>  system_u,
+    content   =>  template($sx_main_file_erb),
+  }
+}

manifests/params.pp

@@ -25,12 +25,19 @@
 #   to choose, i.e. `latest` or `present`.
 # @param  [boolean] sx_install_setools Whether to install additional selinux
 #   tools, i.e. for troubleshooting.
+# @param  [string] sx_selinux_status The desired selinux status. Valid values
+#   are `enforcing`, ``permissive`, `disabled`. Note that changing from disabled
+#   to any othe other types requires a manual reboot to relable the file system.
+# @param  [string]  sx_selinux_type The desired selinux type. Valid options are
+#   `targeted`, `minimum` and `mls`.
 ##############################################################################
 class cd_selinux::params (
 
 $pkg_ensure           = 'latest',
 
 $sx_install_setools   = false,
+$sx_selinux_status    = 'enforcing',
+$sx_selinux_type      = 'targeted',
 
 ) {
 
@@ -45,7 +52,12 @@ $reqpackages_tools  = $::operatingsystem ? {
   }
 
 # directories
-sx_main_dir   = '/etc/selinux'
+$sx_main_dir        = '/etc/selinux'
+
+# files
+$sx_main_file       = "${sx_main_dir}/config"
+$sx_main_file_erb   = 'cd_selinux/main/selinux_config.erb'
+
 
 # includes must be last
   include cd_selinux::main::config

templates/main/selinux_config.erb

@@ -0,0 +1,7 @@
+################################################################################
+##########        /etc/selinux/config managed by Puppet               ##########
+##########        manual changes will be overwritten !!!              ##########
+################################################################################
+SELINUX=<%= @sx_selinux_status %>
+
+SELINUXTYPE=<%= @sx_selinux_type %>