(non-Docker) acceptance test fails because of SELinux when trying to bind to mail ports

[wyardley]

I don't know whether it's failing in Docker, but in the Beaker tests in Vagrant, puppet-nginx is failing:

     # ./spec/acceptance/nginx_mail_spec.rb:22:in `block (2 levels) in <top (required)>'

  2) nginx::resource::mailhost define: Port "587" should be listening
     Failure/Error: it { is_expected.to be_listening }
       expected Port "587" to be listening
       
     # ./spec/acceptance/nginx_mail_spec.rb:31:in `block (3 levels) in <top (required)>'

  3) nginx::resource::mailhost define: Port "465" should be listening
     Failure/Error: it { is_expected.to be_listening }
       expected Port "465" to be listening
       
     # ./spec/acceptance/nginx_mail_spec.rb:35:in `block (3 levels) in <top (required)>'

This is failing because of SELinux.

In the Audit log:

type=AVC msg=audit(1503616309.721:3284): avc:  denied  { name_bind } for  pid=11001 comm="nginx" src=587 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:smtp_port_t:s0 tclass=tcp_socket

The Puppet Selinux module and semanage are not enabled. Not sure if the best approach is:

1. Try and add an option for the module to manage SELinux so that end users can set it if necessary
2. Just set selinux to permissive mode (in a hacky way) in spec_helper_acceptance but make no changes to the module
3. Do a less hack-ish fix in acceptance test but leave responsibility for detecting / fixing this problem to the user.

semanage port -a -t http_port_t -p tcp 465 won't work, because it's already in smtp_port_t.

[wyardley]

Can verify that the same tests pass when running:

% export BEAKER_set=docker/centos-7
% export PUPPET_INSTALL_TYPE=agent 
% bundle exec rake beaker