Puppet users - Aug 2011 - Exec resource not being applied properly

Hi folks,

I have the following resource on my test environ:

exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
/etc/selinux/config":
    path => [ ''/usr/bin'', ''/bin'' ],
    onlyif => "/bin/grep ''^SELINUX=enforcing''
/etc/sysconfig/selinux
2>/dev/null",
    logoutput => true,
}

Whenever I run:
puppet agent  --no-daemonize --test --environment development

I get the following:
debug: Exec[/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
/etc/selinux/config](provider=posix): Executing check ''/bin/grep
''^SELINUX=enforcing'' /etc/sysconfig/selinux
2>/dev/null''
debug: Executing ''/bin/grep ''^SELINUX=enforcing''
/etc/sysconfig/selinux
2>/dev/null''


If I run these commands individually, it works fine. When I run through
puppet, it fails to get the file changes. Does anyone know why? Could it be
because of the --test switch, although it does not execute in --noop mode?

I appreciate any help

thanks,
-fred

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

I think you may have a typo in your resource:
/bin/sed -i ''s/^SELINUX=enforcing/SELINUX=disabled/''

should have ''-e'' after ''-i'' I believe.

On Fri, Aug 26, 2011 at 8:03 AM, Frederiko Costa
<frederiko@gmail.com>wrote:
> Hi folks,
>
> I have the following resource on my test environ:
>
> exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
> /etc/selinux/config":
>     path => [ ''/usr/bin'', ''/bin'' ],
>     onlyif => "/bin/grep ''^SELINUX=enforcing''
/etc/sysconfig/selinux
> 2>/dev/null",
>     logoutput => true,
> }
>
> Whenever I run:
> puppet agent  --no-daemonize --test --environment development
>
> I get the following:
> debug: Exec[/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
> /etc/selinux/config](provider=posix): Executing check ''/bin/grep
> ''^SELINUX=enforcing'' /etc/sysconfig/selinux
> 2>/dev/null''
> debug: Executing ''/bin/grep ''^SELINUX=enforcing''
/etc/sysconfig/selinux
> 2>/dev/null''
>
>
> If I run these commands individually, it works fine. When I run through
> puppet, it fails to get the file changes. Does anyone know why? Could it be
> because of the --test switch, although it does not execute in --noop mode?
>
> I appreciate any help
>
> thanks,
> -fred
>
>
>  --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To post to this group, send email to puppet-users@googlegroups.com.
> To unsubscribe from this group, send email to
> puppet-users+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/puppet-users?hl=en.
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

On 08/26/2011 11:03 AM, Frederiko Costa wrote:
> Hi folks,
> 
> I have the following resource on my test environ:
> 
> exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
/etc/selinux/config":
>     path => [ ''/usr/bin'', ''/bin'' ],
>     onlyif => "/bin/grep ''^SELINUX=enforcing''
/etc/sysconfig/selinux 2>/dev/null",
>     logoutput => true,
> }
As an alternative to the exec method, you might want to look into using the
augeas type instead.  It''s capable of reading /etc/sysconfig/selinux
and
managing the entries within it.

-- 
Frank Sweetser fs at wpi.edu    |  For every problem, there is a solution that
Manager of Network Operations   |  is simple, elegant, and wrong.
Worcester Polytechnic Institute |           - HL Mencken

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

Or just push a new file, that''s what we do.

On Fri, Aug 26, 2011 at 8:16 AM, Frank Sweetser <fs@wpi.edu> wrote:
> On 08/26/2011 11:03 AM, Frederiko Costa wrote:
> > Hi folks,
> >
> > I have the following resource on my test environ:
> >
> > exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
> /etc/selinux/config":
> >     path => [ ''/usr/bin'',
''/bin'' ],
> >     onlyif => "/bin/grep
''^SELINUX=enforcing'' /etc/sysconfig/selinux
> 2>/dev/null",
> >     logoutput => true,
> > }
>
> As an alternative to the exec method, you might want to look into using the
> augeas type instead.  It''s capable of reading
/etc/sysconfig/selinux and
> managing the entries within it.
>
> --
> Frank Sweetser fs at wpi.edu    |  For every problem, there is a solution
> that
> Manager of Network Operations   |  is simple, elegant, and wrong.
> Worcester Polytechnic Institute |           - HL Mencken
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To post to this group, send email to puppet-users@googlegroups.com.
> To unsubscribe from this group, send email to
> puppet-users+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/puppet-users?hl=en.
>
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

Hi folks,

Thanks for the quick help

Aaron - the -i does an in place modification. If I run on the command-line,
works fine. If I don''t use -i, I would have to use some sort of
redirection
and replace the original file. I will try placing -e as well for testing
sake
"-i[SUFFIX], --in-place[=SUFFIX]
              edit files in place (makes backup if extension supplied)"

Frank - I will read about the augeas type. As a newbie in Puppet, it was
unknown to me.

Thanks,
-fred




On Fri, Aug 26, 2011 at 8:16 AM, Frank Sweetser <fs@wpi.edu> wrote:
> On 08/26/2011 11:03 AM, Frederiko Costa wrote:
> > Hi folks,
> >
> > I have the following resource on my test environ:
> >
> > exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
> /etc/selinux/config":
> >     path => [ ''/usr/bin'',
''/bin'' ],
> >     onlyif => "/bin/grep
''^SELINUX=enforcing'' /etc/sysconfig/selinux
> 2>/dev/null",
> >     logoutput => true,
> > }
>
> As an alternative to the exec method, you might want to look into using the
> augeas type instead.  It''s capable of reading
/etc/sysconfig/selinux and
> managing the entries within it.
>
> --
> Frank Sweetser fs at wpi.edu    |  For every problem, there is a solution
> that
> Manager of Network Operations   |  is simple, elegant, and wrong.
> Worcester Polytechnic Institute |           - HL Mencken
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To post to this group, send email to puppet-users@googlegroups.com.
> To unsubscribe from this group, send email to
> puppet-users+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/puppet-users?hl=en.
>
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

I''m clear on what -i does, but I thought -e was also required. 
I''m not a
sed expert, but last time I left out -e things went rather badly.

On Fri, Aug 26, 2011 at 8:25 AM, Frederiko Costa
<frederiko@gmail.com>wrote:
> Hi folks,
>
> Thanks for the quick help
>
> Aaron - the -i does an in place modification. If I run on the command-line,
> works fine. If I don''t use -i, I would have to use some sort of
redirection
> and replace the original file. I will try placing -e as well for testing
> sake
> "-i[SUFFIX], --in-place[=SUFFIX]
>               edit files in place (makes backup if extension
supplied)"
>
> Frank - I will read about the augeas type. As a newbie in Puppet, it was
> unknown to me.
>
> Thanks,
> -fred
>
>
>
>
> On Fri, Aug 26, 2011 at 8:16 AM, Frank Sweetser <fs@wpi.edu> wrote:
>
>> On 08/26/2011 11:03 AM, Frederiko Costa wrote:
>> > Hi folks,
>> >
>> > I have the following resource on my test environ:
>> >
>> > exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
>> /etc/selinux/config":
>> >     path => [ ''/usr/bin'',
''/bin'' ],
>> >     onlyif => "/bin/grep
''^SELINUX=enforcing'' /etc/sysconfig/selinux
>> 2>/dev/null",
>> >     logoutput => true,
>> > }
>>
>> As an alternative to the exec method, you might want to look into using
>> the
>> augeas type instead.  It''s capable of reading
/etc/sysconfig/selinux and
>> managing the entries within it.
>>
>> --
>> Frank Sweetser fs at wpi.edu    |  For every problem, there is a
solution
>> that
>> Manager of Network Operations   |  is simple, elegant, and wrong.
>> Worcester Polytechnic Institute |           - HL Mencken
>>
>> --
>> You received this message because you are subscribed to the Google
Groups
>> "Puppet Users" group.
>> To post to this group, send email to puppet-users@googlegroups.com.
>> To unsubscribe from this group, send email to
>> puppet-users+unsubscribe@googlegroups.com.
>> For more options, visit this group at
>> http://groups.google.com/group/puppet-users?hl=en.
>>
>>
>  --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To post to this group, send email to puppet-users@googlegroups.com.
> To unsubscribe from this group, send email to
> puppet-users+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/puppet-users?hl=en.
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

> Hi folks,
>
> I have the following resource on my test environ:
>
> exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
/etc/selinux/config":
>     path => [ ''/usr/bin'', ''/bin'' ],
>     onlyif => "/bin/grep ''^SELINUX=enforcing''
/etc/sysconfig/selinux
2>/dev/null",
>     logoutput => true,
> }
	

/bin/egrep: Regular /bin/grep will not do your start (^) matching as you
want.	




This email communication and any files transmitted with it may contain
confidential and or proprietary information and is provided for the use of the
intended recipient only. Any review, retransmission or dissemination of this
information by anyone other than the intended recipient is prohibited. If you
receive this email in error, please contact the sender and delete this
communication and any copies immediately. Thank you.

http://www.encana.com

-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

I will give a try and get back to you soon. You may be correct.

-fred




On Fri, Aug 26, 2011 at 8:30 AM, Aaron Grewell
<aaron.grewell@gmail.com>wrote:
> I''m clear on what -i does, but I thought -e was also required. 
I''m not a
> sed expert, but last time I left out -e things went rather badly.
>
> On Fri, Aug 26, 2011 at 8:25 AM, Frederiko Costa
<frederiko@gmail.com>wrote:
>
>> Hi folks,
>>
>> Thanks for the quick help
>>
>> Aaron - the -i does an in place modification. If I run on the
>> command-line, works fine. If I don''t use -i, I would have to
use some sort
>> of redirection and replace the original file. I will try placing -e as
well
>> for testing sake
>> "-i[SUFFIX], --in-place[=SUFFIX]
>>               edit files in place (makes backup if extension
supplied)"
>>
>> Frank - I will read about the augeas type. As a newbie in Puppet, it
was
>> unknown to me.
>>
>> Thanks,
>> -fred
>>
>>
>>
>>
>> On Fri, Aug 26, 2011 at 8:16 AM, Frank Sweetser <fs@wpi.edu>
wrote:
>>
>>> On 08/26/2011 11:03 AM, Frederiko Costa wrote:
>>> > Hi folks,
>>> >
>>> > I have the following resource on my test environ:
>>> >
>>> > exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
>>> /etc/selinux/config":
>>> >     path => [ ''/usr/bin'',
''/bin'' ],
>>> >     onlyif => "/bin/grep
''^SELINUX=enforcing'' /etc/sysconfig/selinux
>>> 2>/dev/null",
>>> >     logoutput => true,
>>> > }
>>>
>>> As an alternative to the exec method, you might want to look into
using
>>> the
>>> augeas type instead.  It''s capable of reading
/etc/sysconfig/selinux and
>>> managing the entries within it.
>>>
>>> --
>>> Frank Sweetser fs at wpi.edu    |  For every problem, there is a
>>> solution that
>>> Manager of Network Operations   |  is simple, elegant, and wrong.
>>> Worcester Polytechnic Institute |           - HL Mencken
>>>
>>> --
>>> You received this message because you are subscribed to the Google
Groups
>>> "Puppet Users" group.
>>> To post to this group, send email to puppet-users@googlegroups.com.
>>> To unsubscribe from this group, send email to
>>> puppet-users+unsubscribe@googlegroups.com.
>>> For more options, visit this group at
>>> http://groups.google.com/group/puppet-users?hl=en.
>>>
>>>
>>  --
>> You received this message because you are subscribed to the Google
Groups
>> "Puppet Users" group.
>> To post to this group, send email to puppet-users@googlegroups.com.
>> To unsubscribe from this group, send email to
>> puppet-users+unsubscribe@googlegroups.com.
>> For more options, visit this group at
>> http://groups.google.com/group/puppet-users?hl=en.
>>
>
>  --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To post to this group, send email to puppet-users@googlegroups.com.
> To unsubscribe from this group, send email to
> puppet-users+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/puppet-users?hl=en.
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

I tried both suggestions: egrep and adding the -e switch on sed, but none
worked. I''m going to try augeas ...

-fred




On Fri, Aug 26, 2011 at 8:31 AM, Kinzel, David
<David.Kinzel@encana.com>wrote:
> > Hi folks,
> >
> > I have the following resource on my test environ:
> >
> > exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
> /etc/selinux/config":
> >     path => [ ''/usr/bin'',
''/bin'' ],
> >     onlyif => "/bin/grep
''^SELINUX=enforcing'' /etc/sysconfig/selinux
> 2>/dev/null",
> >     logoutput => true,
> > }
>
>
> /bin/egrep: Regular /bin/grep will not do your start (^) matching as you
> want.
>
>
>
>
> This email communication and any files transmitted with it may contain
> confidential and or proprietary information and is provided for the use of
> the
> intended recipient only. Any review, retransmission or dissemination of
> this
> information by anyone other than the intended recipient is prohibited. If
> you
> receive this email in error, please contact the sender and delete this
> communication and any copies immediately. Thank you.
>
> http://www.encana.com
>
> --
> You received this message because you are subscribed to the Google Groups
> "Puppet Users" group.
> To post to this group, send email to puppet-users@googlegroups.com.
> To unsubscribe from this group, send email to
> puppet-users+unsubscribe@googlegroups.com.
> For more options, visit this group at
> http://groups.google.com/group/puppet-users?hl=en.
>
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.

Hi folks,

for the next user looking for help ... augeas did the trick

augeas { "selinux":
    context => "/files/etc/sysconfig/selinux/",
    changes => [ "set SELINUX disabled" ],
}

debug: Augeas[selinux](provider=augeas): Augeas version 0.8.1 is installed
debug: Augeas[selinux](provider=augeas): Will attempt to save and only run
if files
changed

debug: Augeas[selinux](provider=augeas): sending command ''set''
with params
["/files/etc/sysconfig/selinux/SELINUX",
"disabled"]
debug: Augeas[selinux](provider=augeas): Executing ''diff -u
/etc/sysconfig/selinux
/etc/sysconfig/selinux.augnew''

wrong number of arguments (2 for 1)
debug: Augeas[selinux](provider=augeas): Files changed, should execute
debug: Augeas[selinux](provider=augeas): /etc/sysconfig/selinux.augnew moved
to
/etc/sysconfig/selinux

debug: Augeas[selinux](provider=augeas): Closed the augeas connection

thanks for the help!
-fred




On Fri, Aug 26, 2011 at 8:42 AM, Frederiko Costa
<frederiko@gmail.com>wrote:
> I tried both suggestions: egrep and adding the -e switch on sed, but none
> worked. I''m going to try augeas ...
>
> -fred
>
>
>
>
>
> On Fri, Aug 26, 2011 at 8:31 AM, Kinzel, David
<David.Kinzel@encana.com>wrote:
>
>> > Hi folks,
>> >
>> > I have the following resource on my test environ:
>> >
>> > exec { "/bin/sed -i
''s/^SELINUX=enforcing/SELINUX=disabled/''
>> /etc/selinux/config":
>> >     path => [ ''/usr/bin'',
''/bin'' ],
>> >     onlyif => "/bin/grep
''^SELINUX=enforcing'' /etc/sysconfig/selinux
>> 2>/dev/null",
>> >     logoutput => true,
>> > }
>>
>>
>> /bin/egrep: Regular /bin/grep will not do your start (^) matching as
you
>> want.
>>
>>
>>
>>
>> This email communication and any files transmitted with it may contain
>> confidential and or proprietary information and is provided for the use
of
>> the
>> intended recipient only. Any review, retransmission or dissemination of
>> this
>> information by anyone other than the intended recipient is prohibited.
If
>> you
>> receive this email in error, please contact the sender and delete this
>> communication and any copies immediately. Thank you.
>>
>> http://www.encana.com
>>
>> --
>> You received this message because you are subscribed to the Google
Groups
>> "Puppet Users" group.
>> To post to this group, send email to puppet-users@googlegroups.com.
>> To unsubscribe from this group, send email to
>> puppet-users+unsubscribe@googlegroups.com.
>> For more options, visit this group at
>> http://groups.google.com/group/puppet-users?hl=en.
>>
>>
>
-- 
You received this message because you are subscribed to the Google Groups
"Puppet Users" group.
To post to this group, send email to puppet-users@googlegroups.com.
To unsubscribe from this group, send email to
puppet-users+unsubscribe@googlegroups.com.
For more options, visit this group at
http://groups.google.com/group/puppet-users?hl=en.