Skip to content

Commit

Permalink
migrater to beaker_puppet_helpers
Browse files Browse the repository at this point in the history
  • Loading branch information
bastelfreak committed Jun 29, 2023
1 parent 424ae8f commit 28bc41b
Show file tree
Hide file tree
Showing 5 changed files with 42 additions and 76 deletions.
10 changes: 5 additions & 5 deletions spec/acceptance/class_disabled_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -11,14 +11,14 @@
# On Debian, SELinux is disabled by default. This first step brings it up to
# par with EL and exercises the Debian-specific code.
context 'when switching from unknown mode to permissive' do
let(:pp) do
let(:manifest) do
<<-EOS
class { 'selinux': mode => 'permissive' }
EOS
end

context 'before reboot' do
it_behaves_like 'a idempotent resource'
it_behaves_like 'an idempotent resource'

describe package(policy_package_for(hosts)) do
it { is_expected.to be_installed }
Expand Down Expand Up @@ -57,7 +57,7 @@ class { 'selinux': mode => 'disabled' }
shell('setenforce Enforcing && test "$(getenforce)" = "Enforcing"')
end

it_behaves_like 'a idempotent resource'
it_behaves_like 'an idempotent resource'

describe file('/etc/selinux/config') do
its(:content) { is_expected.to match(%r{^SELINUX=disabled$}) }
Expand Down Expand Up @@ -95,14 +95,14 @@ class { 'selinux': mode => 'disabled' }
end

context 'when switching from disabled to permissive' do
let(:pp) do
let(:manifest) do
<<-EOS
class { 'selinux': mode => 'permissive' }
EOS
end

context 'before reboot' do
it_behaves_like 'a idempotent resource'
it_behaves_like 'an idempotent resource'

describe file('/etc/selinux/config') do
its(:content) { is_expected.to match(%r{^SELINUX=permissive$}) }
Expand Down
4 changes: 2 additions & 2 deletions spec/acceptance/class_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
ensure_permissive_mode_on(hosts)
end

let(:pp) do
let(:manifest) do
<<-EOS
$have_selinux_ruby_library = #{have_selinux_ruby_library(hosts) ? 'true' : 'false'}
Expand Down Expand Up @@ -105,7 +105,7 @@ class file { read getattr };
# We should really add something for it to purge, but we can't because
# semanage doesn't even exist at the start. maybe a separate spec run after this?

it_behaves_like 'a idempotent resource'
it_behaves_like 'an idempotent resource'

describe package(policy_package_for(hosts)) do
it { is_expected.to be_installed }
Expand Down
4 changes: 2 additions & 2 deletions spec/acceptance/selinux_module_refpolicy_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@
ensure_permissive_mode_on(hosts)
end

let(:pp) do
let(:manifest) do
<<-EOS
class { 'selinux': }
Expand Down Expand Up @@ -62,5 +62,5 @@ class { 'selinux': }
EOS
end

it_behaves_like 'a idempotent resource'
it_behaves_like 'an idempotent resource'
end
70 changes: 3 additions & 67 deletions spec/spec_helper_acceptance.rb
Original file line number Diff line number Diff line change
@@ -1,71 +1,7 @@
# frozen_string_literal: true

require 'beaker-rspec'
require 'beaker-puppet'
require 'beaker/puppet_install_helper'
require 'beaker/module_install_helper'
require 'voxpupuli/acceptance/spec_helper_acceptance'

def policy_package_for(hosts)
case hosts[0]['platform']
when %r{^debian}
'selinux-policy-default'
else
'selinux-policy-targeted'
end
end
configure_beaker

def have_selinux_ruby_library(hosts)
hosts[0]['platform'] !~ %r{^debian}
end

run_puppet_install_helper unless ENV['BEAKER_provision'] == 'no'

RSpec.configure do |c|
# Readable test descriptions
c.formatter = :documentation

# Configure all nodes in nodeset
c.before :suite do
install_module
install_module_dependencies

# Relabelling fails because systemd tries to connect the script's STDIN to
# a serial port that doesn't exist (in Vagrant, at least). Work around like
# in https://bugs.centos.org/view.php?id=13213
hosts.each do |host|
next unless host['platform'] =~ %r{^el-7}

on host, 'sed -i -e "s/console=tty0 console=ttyS0,115200/console=tty0/" /etc/default/grub'
on host, 'cat /etc/default/grub'
on host, 'grub2-mkconfig -o /boot/grub2/grub.cfg'
end
end

c.filter_run_excluding requires_selinux_ruby_library: true unless have_selinux_ruby_library(hosts)
end

shared_examples 'a idempotent resource' do
it 'applies with no errors' do
apply_manifest(pp, catch_failures: true)
end

it 'applies a second time without changes' do
apply_manifest(pp, catch_changes: true)
end
end

def ensure_permissive_mode_on(hosts)
hosts.each do |host|
host.execute('getenforce') do |result|
mode = result.stdout.strip
if mode != 'Permissive'
host.execute('sed -i "s/SELINUX=.*/SELINUX=permissive/" /etc/selinux/config')
if mode == 'Disabled'
host.reboot
else
host.execute('setenforce Permissive && test "$(getenforce)" = "Permissive"')
end
end
end
end
end
Dir['./spec/support/acceptance/**/*.rb'].sort.each { |f| require f }
30 changes: 30 additions & 0 deletions spec/support/acceptance/helper_methods.rb
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# frozen_string_literal: true

def policy_package_for(hosts)
case hosts[0]['platform']
when %r{^debian}
'selinux-policy-default'
else
'selinux-policy-targeted'
end
end

def have_selinux_ruby_library(hosts)
hosts[0]['platform'] !~ %r{^debian}
end

def ensure_permissive_mode_on(hosts)
hosts.each do |host|
host.execute('getenforce') do |result|
mode = result.stdout.strip
if mode != 'Permissive'
host.execute('sed -i "s/SELINUX=.*/SELINUX=permissive/" /etc/selinux/config')
if mode == 'Disabled'
host.reboot
else
host.execute('setenforce Permissive && test "$(getenforce)" = "Permissive"')
end
end
end
end
end

0 comments on commit 28bc41b

Please sign in to comment.