- Purge the workhorse helper methods that had been refactored out from
  other files and clean up the affected spec tests to pass

Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

- Do not automatically use sockets directory, allow a user to set the
  directory

Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

- Run the SELinux helper after GitLab Workhorse and other files are
  created ensuring their file contexts are restored
- Place GitLab Workhorse socket files into a sockets directory allowing
  the SELinux file context to be inherited on service restarts
- Add a GitLab Workhorse helper to ensure that new UNIX sockets for
  Workhorse always inherit the proper SELinux file context

Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

Ian Baum authored 4 years ago and Balasankar C committed 4 years ago

* Matching behavior in rails codebase
* This will be default behavior in 4.0

CentOS 8 requires that pathnames be present when calling `restorecon`,
but this was not a requirement in CentOS 7. We fix this by moving all
SELinux-related changes to the gitlab::selinux recipe so that all the required
files and directories can be made before any SELinux changes are applied. This
makes sense from a code organization standpoint and also has the nice side
effect of removing the need to ignore unknown files (-i option in restorecon)
as well.

This commit is essentially commit 5b992246 by
Stan Hu, rebased against latest master

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

- Release 12.0 will default to JSON logging for all services that
  support it except for the registry. This includes gitaly,
  gitlab-shell, gitlab-workhorse, sidekiq, gitlab-pages.

Resolves: https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4102



Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

Since https://gitlab.com/gitlab-org/gitlab-shell/merge_requests/181,
gitlab-shell no longer can talk to Redis directly. All operations
go through the internal API.

Removing this config is useful for several reasons:

1. It removes dead code.
2. Since the gitlab-shell config is repeatedly parsed with every git
action, removing a few lines can improve performance.
3. There is a bug in string handling when there are YAML characters
included in the Redis password field.

For fast SSH key lookups to work (https://docs.gitlab.com/ee/administration/operations/fast_ssh_key_lookup.html),
SELinux spawns `/opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check`
and needs the following access:

* Read: /var/opt/gitlab/gitlab-shell/config.yml
* Read: /var/opt/gitlab/gitlab-rails/etc/gitlab_shell_secret
* Write: /var/log/gitlab/gitlab-shell/gitlab-shell.log
* Connect: unicorn (port 8080)

Because the SELinux policy is a static policy, right now we don't support the
ability to change internal unicorn ports. Admins would have to create a
special .te file for the environment, or we'd have to dynamically generate it
for them, which is it a bit tricky if they have changed their port contexts.

Granting `http_cache_port_t` permissions also includes access to these ports:

```
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
```

Closes #2855

support for it

- Highlight the warning in yellow
- Print to stdout in additon to the log
- Include the updated config in the output, to make it easy to update
- Sleep for 5 seconds, to increase the possibility the warning will be
seen

Because this warning is thrown during parsing, it will show very close
to the top of the reconfigure run.

This reverts commit 1c75edce, reversing
changes made to a6dbd2b7.

Rubocop

* Using custom_hooks_dir, not custom_hook_dir
* Fixed missed reference in gitlab.rb.template
* Using %r for regex's in specs that reference a path

* By default, do not populate this value
* Change value name to be config_hook_dir

Defaults to package provided directory, but allow the users to point to
their own location. Only updates the config.yml file for gitlab-shell,
assumes the user will manage the directory themselves.

* Using custom_hooks_dir, not custom_hook_dir
* Fixed missed reference in gitlab.rb.template
* Using %r for regex's in specs that reference a path

* By default, do not populate this value
* Change value name to be config_hook_dir

Defaults to package provided directory, but allow the users to point to
their own location. Only updates the config.yml file for gitlab-shell,
assumes the user will manage the directory themselves.

* Update the database upgrade actions to be more clear about what they
are doing
* Move the mocking of helper files out of the individual spec files,
into the main configuration