- Fixes a rubocop warning that popped up after merge conflit.

Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

- Run the SELinux helper after GitLab Workhorse and other files are
  created ensuring their file contexts are restored
- Place GitLab Workhorse socket files into a sockets directory allowing
  the SELinux file context to be inherited on service restarts
- Add a GitLab Workhorse helper to ensure that new UNIX sockets for
  Workhorse always inherit the proper SELinux file context

Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

Balasankar C authored 4 years ago and DJ Mountney committed 4 years ago

Signed-off-by: Balasankar "Balu" C <balasankarc@autistici.org>

CentOS 8 requires that pathnames be present when calling `restorecon`,
but this was not a requirement in CentOS 7. We fix this by moving all
SELinux-related changes to the gitlab::selinux recipe so that all the required
files and directories can be made before any SELinux changes are applied. This
makes sense from a code organization standpoint and also has the nice side
effect of removing the need to ignore unknown files (-i option in restorecon)
as well.

This commit is essentially commit 5b992246 by
Stan Hu, rebased against latest master

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

Since https://gitlab.com/gitlab-org/gitlab-shell/merge_requests/181,
gitlab-shell no longer can talk to Redis directly. All operations
go through the internal API.

Removing this config is useful for several reasons:

1. It removes dead code.
2. Since the gitlab-shell config is repeatedly parsed with every git
action, removing a few lines can improve performance.
3. There is a bug in string handling when there are YAML characters
included in the Redis password field.

Earlier, we replaced gitlab['redis_*'] settings with redis['master_*']
values in sentinel mode. However, this worked only for gitlab-rails and
not for several other services like gitlab-monitor. This commit changes
that and get gitlab-rails the necessary details based on the knowledge
whether sentinels are present or not.

Change ownership to root:git and permission to 0640

For fast SSH key lookups to work (https://docs.gitlab.com/ee/administration/operations/fast_ssh_key_lookup.html),
SELinux spawns `/opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check`
and needs the following access:

* Read: /var/opt/gitlab/gitlab-shell/config.yml
* Read: /var/opt/gitlab/gitlab-rails/etc/gitlab_shell_secret
* Write: /var/log/gitlab/gitlab-shell/gitlab-shell.log
* Connect: unicorn (port 8080)

Because the SELinux policy is a static policy, right now we don't support the
ability to change internal unicorn ports. Admins would have to create a
special .te file for the environment, or we'd have to dynamically generate it
for them, which is it a bit tricky if they have changed their port contexts.

Granting `http_cache_port_t` permissions also includes access to these ports:

```
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
```

Closes #2855

* Using custom_hooks_dir, not custom_hook_dir
* Fixed missed reference in gitlab.rb.template
* Using %r for regex's in specs that reference a path

* By default, do not populate this value
* Change value name to be config_hook_dir

Defaults to package provided directory, but allow the users to point to
their own location. Only updates the config.yml file for gitlab-shell,
assumes the user will manage the directory themselves.

* Using custom_hooks_dir, not custom_hook_dir
* Fixed missed reference in gitlab.rb.template
* Using %r for regex's in specs that reference a path

* By default, do not populate this value
* Change value name to be config_hook_dir

Defaults to package provided directory, but allow the users to point to
their own location. Only updates the config.yml file for gitlab-shell,
assumes the user will manage the directory themselves.

Without making it configurable, and always having it set, logging would always be used
and would take up quite a bit of space.

And also simplify the recipes that make use of manage-storage-directories by moving the condition into the definition