selinux using template instead of binary

Author: Gavin Rogers

files/nginx.selmodule

@@ -65,13 +65,25 @@
   }
   # update SELinux
   if $::selinux_config_mode == 'enforcing' {
-    file{'get-SEL-policy':
-      path    => '/usr/share/selinux/targeted/nginx.pp',
-      source  => 'puppet:///modules/puppet/nginx.selmodule',
-    } ->
     package {'policycoreutils':
       ensure  => 'latest',
     } ->
+    file { 'selinux template':
+      path    =>  '/tmp/nginx.te',
+      ensure  =>  file,
+      content =>  template('puppet/unicorn_selinux_template'),
+    } ->
+    exec { 'building selinux module from template':
+      path    => [ "/usr/bin", "/usr/local/bin" ],
+      command => 'checkmodule -M -m -o /tmp/nginx.mod /tmp/nginx.te'
+    } ->
+    exec { 'building selinux policy package from module':
+      path    => [ "/usr/bin", "/usr/local/bin" ],
+      command => 'semodule_package -o /tmp/nginx.pp -m /tmp/nginx.mod',
+    } ->
+    file { "/usr/share/selinux/targeted/nginx.pp":
+      source => '/tmp/nginx.pp',
+    } ->
     selmodule{'nginx':
       ensure      => 'present',
       syncversion => true,

manifests/unicorn.pp

@@ -0,0 +1,12 @@
+module nginx 1.0;
+  require {
+  type httpd_t;
+  type puppet_var_run_t;
+  class process setrlimit;
+  class sock_file write;
+  class dir search;
+}
+
+#============= httpd_t ==============
+allow httpd_t puppet_var_run_t:sock_file write;
+allow httpd_t puppet_var_run_t:dir search;