{"action":"created","issue":{"url":"https://api.github.com/repos/freedomofpress/ansible-role-grsecurity/issues/48","repository_url":"https://api.github.com/repos/freedomofpress/ansible-role-grsecurity","labels_url":"https://api.github.com/repos/freedomofpress/ansible-role-grsecurity/issues/48/labels{/name}","comments_url":"https://api.github.com/repos/freedomofpress/ansible-role-grsecurity/issues/48/comments","events_url":"https://api.github.com/repos/freedomofpress/ansible-role-grsecurity/issues/48/events","html_url":"https://github.com/freedomofpress/ansible-role-grsecurity/issues/48","id":140064392,"number":48,"title":"add variable name for including pre-made .config file","user":{"login":"Andrew415","id":6968468,"avatar_url":"https://avatars.githubusercontent.com/u/6968468?v=3","gravatar_id":"","url":"https://api.github.com/users/Andrew415","html_url":"https://github.com/Andrew415","followers_url":"https://api.github.com/users/Andrew415/followers","following_url":"https://api.github.com/users/Andrew415/following{/other_user}","gists_url":"https://api.github.com/users/Andrew415/gists{/gist_id}","starred_url":"https://api.github.com/users/Andrew415/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Andrew415/subscriptions","organizations_url":"https://api.github.com/users/Andrew415/orgs","repos_url":"https://api.github.com/users/Andrew415/repos","events_url":"https://api.github.com/users/Andrew415/events{/privacy}","received_events_url":"https://api.github.com/users/Andrew415/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-11T02:04:40Z","updated_at":"2016-04-27T17:41:34Z","closed_at":null,"body":"I have a painstakingly curated .config with the grsec/pax options I want to use. As of now I can manually add a copy: to the install-grsec-kernel for it to be built automatically.\r\n\r\nHowever I wonder if it be useful to seamlessly add it to the grsec playbook with a variable and automatic copy task, would this be possible?\r\n\r\nPersonally I find that unless someone really knows the precise kernel features that they know they need, leaving it to common users to figure out is an error prone process and that they would be better off with a strict kernel config file at first and only later open it up if needed for some feature they require.\r\n\r\nThis feature is probably only worthwhile for the install-grsec-kernel playbook. \r\n\r\nIf this seems reasonable, something else I thought of considerations is the inclusion of arrays of possible GRKERNSEC profiles such as listed on https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity_and_PaX_Configuration_Options#Usage_Type\r\n\r\nsome of which make a lot of sense for this playbook out of the box:\r\n\r\nGRKERNSEC_CONFIG_SERVER=y\r\nGRKERNSEC_CONFIG_VIRT_GUEST=y\r\nGRKERNSEC_CONFIG_VIRT_VIRTUALBOX=y\r\n\r\nwhich could be a single variable like:\r\n\r\n{{ grkernsec_server_virt_guest_virtualbox}} (or something to that effect)\r\n\r\nif users of this playbook intend to use it for servers or desktops ( {{ grkernsec_desktop}} ), they should be able to copy the playbook into a new directory and change the default profile definitions inside defaults/main.yml and be done with any required changes. Currently that is not possible because it requires manually updating the .config file on the system which is something we want users to avoid with orchestration.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/freedomofpress/ansible-role-grsecurity/issues/comments/215166738","html_url":"https://github.com/freedomofpress/ansible-role-grsecurity/issues/48#issuecomment-215166738","issue_url":"https://api.github.com/repos/freedomofpress/ansible-role-grsecurity/issues/48","id":215166738,"user":{"login":"conorsch","id":657862,"avatar_url":"https://avatars.githubusercontent.com/u/657862?v=3","gravatar_id":"","url":"https://api.github.com/users/conorsch","html_url":"https://github.com/conorsch","followers_url":"https://api.github.com/users/conorsch/followers","following_url":"https://api.github.com/users/conorsch/following{/other_user}","gists_url":"https://api.github.com/users/conorsch/gists{/gist_id}","starred_url":"https://api.github.com/users/conorsch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/conorsch/subscriptions","organizations_url":"https://api.github.com/users/conorsch/orgs","repos_url":"https://api.github.com/users/conorsch/repos","events_url":"https://api.github.com/users/conorsch/events{/privacy}","received_events_url":"https://api.github.com/users/conorsch/received_events","type":"User","site_admin":false},"created_at":"2016-04-27T17:41:34Z","updated_at":"2016-04-27T17:41:34Z","body":"Managing multiple configs on a per-host basis can be quite irritating without a dedicated var, as @Andrew415 proposes. The safest approach for backwards compatibility is leveraging a `with_first_found` include for a custom config file, or falling back to one of the `grsecurity_build_strategy` vars that ship with the role. That way we can continue to support multiple common \"vanilla\" setups by shipping configs with the role, but also support arbitrary config files via a custom path."}}