On 12/04/16 19:10, John Jasen wrote:
> Out of faint curiosity, how do we push change requests upstream to RHEL?
>
> I'm using puppet to automate systems, including the application of
> SELinux policy. While setsebool -P is non-damaging to repeat, it is time
> consuming -- taking about 45 seconds per execution to process the
> existing policy and re-commit to disk.
>
> I'd like a simple ability to put an unless in the execution of
> setsebool, to key off whether its necessary -- to reduce a SELinux
> puppet run from 250 seconds to about 60. Unfortunately, in the current
> format, getsebool has defeated me.
>
> Would it be possible to have getsebool extended, so something like
> getsebool -b $variablename would return true or false as the exit code?
>
Trying to understand what you want to do, as puppet has native resource
type for this :
class selinux::booleans::httpd_can_network_connect {
selboolean {'httpd_can_network_connect':
value => on,
persistent => true,
}
}
So why are you trying to use Exec resource type mixed with unless ?
--
Fabian Arrotin
The CentOS Project | http://www.centos.org
gpg key: 56BEC54E | twitter: @arrfab
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL: <http://lists.centos.org/pipermail/centos/attachments/20160413/b886a559/attachment-0005.sig>