directory_source of selinux_policy_module does seem to work… about selinux_policy HOT 7 CLOSED

Hi. I don't think I support this kind of use case - installing a compiled module.
You can revert to the source files and use this resource, add the required functionality (we can think about what goes where together), or avoid using this resource and opt for an execute resource for installing your pe file.
LMK what you think

from selinux_policy.

Aha.
Use directory and populate that directory using cookbook_file
If you think the documentation could explain it better, please LMK

from selinux_policy.

Yes! using directory populated up front with a remote_directory is working.

### Populate a remote working directory
remote_directory '/tmp/selinux-qas' do
  source 'selinux-qas'
  owner 'root'
  group 'root'
  mode '0755'
  action :create
end

### Install the SELinux policies
if node['platform'] == 'redhat'
  include_recipe 'selinux_policy::default'
  selinux_policy_module 'sshdqas' do
    directory '/tmp/selinux-qas'
    action  :install
  end
end

Do you estimate it as an right way of working? If yes, I propose that a small note could be added in the doc to the directory attribute, and maybe add an extra example usage.

Anyway, I try to improve a bit my recipes by using .te files in place of .pp. Even I don't plan to edit those, it is still better to have the .te files versioned in Git.

Thanks

from selinux_policy.

Voila, pull request on README.md done as draft for de doc change

from selinux_policy.

I personally dislike putting "compiled" stuff in my cookbook.
I support either:

• keeping the source in the cookbook and compiling it on the machine
• keeping the compiled result in an artifact store of some kind and pulling it from there

The first works with directory_source, the second with directory and something that puts files in that directory.

This is of course only my thought about doing stuff, and isn't necessarily the best way for everyone.

Happy to hear everything works. Will review your README modification

from selinux_policy.

+1 for your comment about keeping the .te. It's just a better idea to keep the source, in case you DO want to modify something, rather than having "this is the binary can't regnerate it"

from selinux_policy.

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

from selinux_policy.