Puppet SELinux support and an introduction

[Sean E. Millichamp]

Hi everyone,

I have been working on getting some SELinux support into Puppet, based
on some initial work by Frank Sweetser.  I know the Fedora
Infrastructure team uses Puppet and I heard a rumor that there was
interest here in better SELinux support.

ReductiveLabs just cut a 0.24.6rc1 containing this support.  If you
would like to test it I would certainly appreciate any feedback and
bugreports.  I believe they intend to release 0.24.6 as soon as
possible, so the sooner the better.

Now a brief introduction, since I know that is the thing to do on this
mailing list:

I ran my first Linux-in-production system in 1996, started the switch to
Red Hat Linux 4.2 as soon as it was released, and have been using RHL,
RHEL, CentOS, and Fedora since on both servers and on my desktop (as my
exclusive OS since around 1999).  These days I am a senior systems
architect for a web-based firm that did around 1.2 billion page views in
2007 supported by around 300 Linux servers running our various dev,
test, and prod environments.  Some of the key technologies in use here
are Apache, Perl/mod_perl, MySQL, MySQL cluster, RH Cluster Suite/GFS,
Nagios, Cobbler/Kickstart for deployment, cfengine (and soon to be
Puppet) for configuration management.  My current main task is
reimplementing our cfengine configurations in Puppet so I've been deep
in Puppet recently.

I have this idea that I would like to help on the Fedora Infrastructure
team, to help contribute something back to Fedora, but between job and
family feel that I probably don't have the time needed to dedicate to
it, so I had just been lurking here until now.

Cheers,
Sean

[Mike McGrath]

On Thu, 9 Oct 2008, Sean E. Millichamp wrote:

>  Hi everyone,
>
>  I have been working on getting some SELinux support into Puppet, based
>  on some initial work by Frank Sweetser.  I know the Fedora
>  Infrastructure team uses Puppet and I heard a rumor that there was
>  interest here in better SELinux support.
>
>  ReductiveLabs just cut a 0.24.6rc1 containing this support.  If you
>  would like to test it I would certainly appreciate any feedback and
>  bugreports.  I believe they intend to release 0.24.6 as soon as
>  possible, so the sooner the better.
>  
Can we test it just on a node or does the puppet master require an update
as well?

>  Now a brief introduction, since I know that is the thing to do on
> this
>  mailing list:
>
>  I ran my first Linux-in-production system in 1996, started the switch to
>  Red Hat Linux 4.2 as soon as it was released, and have been using RHL,
>  RHEL, CentOS, and Fedora since on both servers and on my desktop (as my
>  exclusive OS since around 1999).  These days I am a senior systems
>  architect for a web-based firm that did around 1.2 billion page views in
>  2007 supported by around 300 Linux servers running our various dev,
>  test, and prod environments.  Some of the key technologies in use here
>  are Apache, Perl/mod_perl, MySQL, MySQL cluster, RH Cluster Suite/GFS,
>  Nagios, Cobbler/Kickstart for deployment, cfengine (and soon to be
>  Puppet) for configuration management.  My current main task is
>  reimplementing our cfengine configurations in Puppet so I've been deep
>  in Puppet recently.
>
>  I have this idea that I would like to help on the Fedora Infrastructure
>  team, to help contribute something back to Fedora, but between job and
>  family feel that I probably don't have the time needed to dedicate to
>  it, so I had just been lurking here until now.
>  
Welcome!  we currently have some in house type stuff for SELinux that we
have been using in anticipation of the native support.  Its mostly just
defines with execs and things.  Welcome to the list!

	-Mike

[brett lentz]

On Thu, 2008-10-09 at 19:51 -0500, Mike McGrath wrote:
>  On Thu, 9 Oct 2008, Sean E. Millichamp wrote:
>  
>  > Hi everyone,
>  >
>  > I have been working on getting some SELinux support into Puppet, based
>  > on some initial work by Frank Sweetser.  I know the Fedora
>  > Infrastructure team uses Puppet and I heard a rumor that there was
>  > interest here in better SELinux support.
>  >
>  > ReductiveLabs just cut a 0.24.6rc1 containing this support.  If you
>  > would like to test it I would certainly appreciate any feedback and
>  > bugreports.  I believe they intend to release 0.24.6 as soon as
>  > possible, so the sooner the better.
>  >
>  
>  Can we test it just on a node or does the puppet master require an update
>  as well? 
It will require the puppet master to be upgraded.

This is the first cut of the patch I pushed upstream a month or so ago.


---Brett.

Even if you persuade me, you won't persuade me.
		-- Aristophanes