Page MenuHomeDevCentral
Files F3987324

D1959.id4955.diff
No OneTemporary
Actions

D1959.id4955.diff
View Options

diff --git a/roles/paas-docker/nginx/files/selinux/nginx.te b/roles/paas-docker/nginx/files/selinux/nginx.te
new file mode 100644
--- /dev/null
+++ b/roles/paas-docker/nginx/files/selinux/nginx.te
@@ -0,0 +1,26 @@
+# -------------------------------------------------------------
+# Configuration for Let's encrypt nginx
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# Created: 2018-10-27
+# Description: SELinux policy for nginx
+# Allow to serve containers generated files
+# Source file: roles/paas-docker/nginx/files/selinux/nginx.te
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+policy_module(nginx, 1.0)
+
+require {
+ type httpd_t;
+}
+
+#============= httpd_t ==============
+virt_exec_sandbox_files(httpd_t)
+virt_read_sandbox_files(httpd_t)
diff --git a/roles/paas-docker/nginx/selinux.sls b/roles/paas-docker/nginx/selinux.sls
--- a/roles/paas-docker/nginx/selinux.sls
+++ b/roles/paas-docker/nginx/selinux.sls
@@ -19,4 +19,31 @@
- value: True
- persist: True
+# -------------------------------------------------------------
+# Custom SELinux policies
+#
+# :: Give access to container files Let's Encrypt (T1364)
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+policycoreutils-devel:
+ pkg.installed
+
+/usr/local/share/selinux/nginx.te:
+ file.managed:
+ - source: salt://roles/paas-docker/nginx/files/selinux/nginx.te
+ - makedirs: True
+
+/usr/local/share/selinux/nginx.pp:
+ cmd.run:
+ - name: make -f /usr/share/selinux/devel/Makefile nginx.pp
+ - creates: /usr/local/share/selinux/nginx.pp
+ - cwd: /usr/local/share/selinux
+
+install_selinux_nginx_module:
+ cmd.run:
+ - name: semodule -i nginx.pp
+ - cwd: /usr/local/share/selinux
+ - onchanges:
+ - cmd: /usr/local/share/selinux/nginx.pp
+
{% endif %}
diff --git a/roles/paas-docker/wwwroot-502/init.sls b/roles/paas-docker/wwwroot-502/init.sls
--- a/roles/paas-docker/wwwroot-502/init.sls
+++ b/roles/paas-docker/wwwroot-502/init.sls
@@ -6,6 +6,8 @@
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
+{% set has_selinux = salt['grains.get']('selinux:enabled', False) %}
+
/var/wwwroot-502:
file.recurse:
- source: salt://wwwroot/502
@@ -13,3 +15,15 @@
- include_empty: True
- dir_mode: 755
- file_mode: 644
+
+{% if has_selinux %}
+wwwroot_502_selinux_context:
+ selinux.fcontext_policy_present:
+ - name: /var/wwwroot-502(/.*)?
+ - sel_type: httpd_sys_rw_content_t
+
+wwwroot_502_selinux_context_applied:
+ selinux.fcontext_policy_applied:
+ - name: /var/wwwroot-502
+ - recursive: True
+{% endif %}

File Metadata

Mime Type
text/plain
Expires
Thu, Jan 9, 09:21 (3 h, 32 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2341545
Default Alt Text
D1959.id4955.diff (2 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator