Ian Baum authored 4 years ago and Balasankar C committed 4 years ago

* Matching behavior in rails codebase
* This will be default behavior in 4.0

CentOS 8 requires that pathnames be present when calling `restorecon`,
but this was not a requirement in CentOS 7. We fix this by moving all
SELinux-related changes to the gitlab::selinux recipe so that all the required
files and directories can be made before any SELinux changes are applied. This
makes sense from a code organization standpoint and also has the nice side
effect of removing the need to ignore unknown files (-i option in restorecon)
as well.

This commit is essentially commit 5b992246 by
Stan Hu, rebased against latest master

Signed-off-by: Balasankar "Balu" C <balasankar@gitlab.com>

- Release 12.0 will default to JSON logging for all services that
  support it except for the registry. This includes gitaly,
  gitlab-shell, gitlab-workhorse, sidekiq, gitlab-pages.

Resolves: https://gitlab.com/gitlab-org/omnibus-gitlab/issues/4102



Signed-off-by: Robert Marshall <rmarshall@gitlab.com>

Since https://gitlab.com/gitlab-org/gitlab-shell/merge_requests/181,
gitlab-shell no longer can talk to Redis directly. All operations
go through the internal API.

Removing this config is useful for several reasons:

1. It removes dead code.
2. Since the gitlab-shell config is repeatedly parsed with every git
action, removing a few lines can improve performance.
3. There is a bug in string handling when there are YAML characters
included in the Redis password field.

For fast SSH key lookups to work (https://docs.gitlab.com/ee/administration/operations/fast_ssh_key_lookup.html),
SELinux spawns `/opt/gitlab/embedded/service/gitlab-shell/bin/gitlab-shell-authorized-keys-check`
and needs the following access:

* Read: /var/opt/gitlab/gitlab-shell/config.yml
* Read: /var/opt/gitlab/gitlab-rails/etc/gitlab_shell_secret
* Write: /var/log/gitlab/gitlab-shell/gitlab-shell.log
* Connect: unicorn (port 8080)

Because the SELinux policy is a static policy, right now we don't support the
ability to change internal unicorn ports. Admins would have to create a
special .te file for the environment, or we'd have to dynamically generate it
for them, which is it a bit tricky if they have changed their port contexts.

Granting `http_cache_port_t` permissions also includes access to these ports:

```
http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
http_cache_port_t              udp      3130
```

Closes #2855

support for it

- Highlight the warning in yellow
- Print to stdout in additon to the log
- Include the updated config in the output, to make it easy to update
- Sleep for 5 seconds, to increase the possibility the warning will be
seen

Because this warning is thrown during parsing, it will show very close
to the top of the reconfigure run.

This reverts commit 1c75edce, reversing
changes made to a6dbd2b7.

Rubocop

* Using custom_hooks_dir, not custom_hook_dir
* Fixed missed reference in gitlab.rb.template
* Using %r for regex's in specs that reference a path

* By default, do not populate this value
* Change value name to be config_hook_dir

Defaults to package provided directory, but allow the users to point to
their own location. Only updates the config.yml file for gitlab-shell,
assumes the user will manage the directory themselves.

* Using custom_hooks_dir, not custom_hook_dir
* Fixed missed reference in gitlab.rb.template
* Using %r for regex's in specs that reference a path

* By default, do not populate this value
* Change value name to be config_hook_dir

Defaults to package provided directory, but allow the users to point to
their own location. Only updates the config.yml file for gitlab-shell,
assumes the user will manage the directory themselves.

* Update the database upgrade actions to be more clear about what they
are doing
* Move the mocking of helper files out of the individual spec files,
into the main configuration