diff --git a/linux/map.jinja b/linux/map.jinja index da37a63e..0f0a44ac 100644 --- a/linux/map.jinja +++ b/linux/map.jinja @@ -15,8 +15,11 @@ 'package': {}, 'autoupdates': { 'pkgs': [] - }, - 'selinux': 'permissive', + }, + 'selinux': { + 'pkgs': [], + 'mode': 'permissive', + }, 'ca_certs_dir': '/usr/local/share/ca-certificates', 'ca_certs_bin': 'update-ca-certificates', 'atop': { @@ -25,7 +28,7 @@ 'autostart': true, 'logpath': '/var/log/atop', 'outfile': '/var/log/atop/daily.log' - }, + }, 'at': { 'pkgs': [], 'services': [] @@ -52,7 +55,10 @@ 'autoupdates': { 'pkgs': ['unattended-upgrades'] }, - 'selinux': 'permissive', + 'selinux': { + 'pkgs': [], + 'mode': 'permissive', + }, 'ca_certs_dir': '/usr/local/share/ca-certificates', 'ca_certs_bin': 'update-ca-certificates', 'atop': { @@ -74,7 +80,7 @@ }, }, 'RedHat': { - 'pkgs': ['policycoreutils', 'policycoreutils-python', 'telnet', 'wget'], + 'pkgs': ['telnet', 'wget'], 'utc': true, 'user': {}, 'group': {}, @@ -90,7 +96,10 @@ 'autoupdates': { 'pkgs': [] }, - 'selinux': 'permissive', + 'selinux': { + 'pkgs': ['policycoreutils','policycoreutils-python'], + 'mode': 'permissive', + }, 'ca_certs_dir': '/etc/pki/ca-trust/source/anchors', 'ca_certs_bin': 'update-ca-trust extract', 'atop': { @@ -381,6 +390,7 @@ Debian: 'pkgs': [], 'service': 'multipath' }, + 'lvm_pkgs': ['lvm2'], }, }, merge=salt['grains.filter_by']({ 'trusty': { diff --git a/linux/system/selinux.sls b/linux/system/selinux.sls index 245cc8d0..0ccfab08 100644 --- a/linux/system/selinux.sls +++ b/linux/system/selinux.sls @@ -1,18 +1,29 @@ {%- from "linux/map.jinja" import system with context %} {%- if system.selinux is defined %} +{%- if grains.os_family == 'RedHat' %} -include: -- linux.system.repo +{% if system.selinux is mapping %} -{%- if grains.os_family == 'RedHat' %} - {%- set mode = system.selinux %} + {% if system.selinux.pkgs %} +linux_system_selinux_pkgs: + pkg.installed: + - pkgs: {{ system.selinux.pkgs }} + {%- endif %} -{{ mode }}: + {%- if system.selinux.mode %} +{{ system.selinux.mode }}: selinux.mode: - require: - - pkg: linux_repo_prereq_pkgs + - pkg: linux_system_selinux_pkgs + {%- endif %} -{%- endif %} + {%- else %} +{{ system.selinux }}: + selinux.mode + + {%- endif %} + +{%- endif %} {%- endif %} diff --git a/tests/pillar/system.sls b/tests/pillar/system.sls index 825b04b1..f0385b96 100644 --- a/tests/pillar/system.sls +++ b/tests/pillar/system.sls @@ -24,7 +24,8 @@ linux: domain: ci.local environment: prd purge_repos: true - selinux: permissive + selinux: + mode: permissive directory: /tmp/test: makedirs: true