selinux::module should not manage files in /usr about puppet-selinux HOT 6 CLOSED

manifests have access to the $settings::vardir variable, which is the vardir option of the agent. For example on my desktop:
sudo puppet apply -e 'notice($settings::vardir)' results in Notice: Scope(Class[main]): /var/lib/puppet and without sudo in Notice: Scope(Class[main]): /home/oranenj/.puppet/cache

from puppet-selinux.

from puppet-selinux.

Ah, yes, I misread the documentation... I wonder if there's a good way to get the configured vardir value somehow via Puppet's ruby API... Puppet.settings.setting('vardir').value returns nil if called straight from ruby.

from puppet-selinux.

However, it seems to work when called in a fact during a puppet run:

require 'puppet'
Facter.add(:puppet_agent_vardir) do
  setcode do
    Puppet.settings['vardir']
  end
end

$ FACTERLIB=. sudo -E puppet apply -e'notice($::puppet_agent_vardir)'
Notice: Scope(Class[main]): /var/lib/puppet

from puppet-selinux.

I think Puppet.settings outside of a puppet run needs to call some initialization method first.

I don't think we should rely on a client provided directory. The worst case could be that somebody sets is to "/" and we're purging "/" in the end.

from puppet-selinux.

Well of course we shouldn't use the directory directly, but if we set it to something like $client_vardir/selinux-module-cache and validate that it's an absolute path, even in the worst case we'll just have a directory called /selinux-module-cache

from puppet-selinux.