X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fgrub%2Fmanifests%2Finit.pp;h=73ec4eca09a157bfc772a091f09a79e6a22b740b;hb=bedd29e6a7b4c3539e37d23c9025898fb1f9311c;hp=a3257977ff6dce743f7a3c8a055a828d1ac069bd;hpb=46e56a7907eeae9e7da98bb94816cf66578d845e;p=mirror%2Fdsa-puppet.git

diff --git a/modules/grub/manifests/init.pp b/modules/grub/manifests/init.pp
index a3257977f..73ec4eca0 100644
--- a/modules/grub/manifests/init.pp
+++ b/modules/grub/manifests/init.pp
@@ -25,11 +25,13 @@ class grub {
 		$grub_manage = false
 	}
 
-	if $grub_manage {
+	if ($::update_grub and $grub_manage) {
 		# hp-health requires nopat on linux 4.9
 		$grub_do_nopat = ($::systemproductname and $::systemproductname =~ /^ProLiant/ and versioncmp($::kernelversion, '4.9') >= 0)
 
-		$grub_do_extra = $::hostname in [fasolo]
+		$grub_do_pti_on = ($::debarchitecture == 'amd64' and versioncmp($::lsbmajdistrelease, '9') >= 0)
+
+		$grub_do_extra = $::hostname in [fasolo,grnet-node01,grnet-node02]
 
 		file { '/etc/default/grub':
 			# restore to default
@@ -75,6 +77,12 @@ class grub {
 			content  => template('grub/puppet-kernel-extra.cfg.erb'),
 			notify  => Exec['update-grub']
 		}
+
+		file { '/etc/default/grub.d/puppet-kernel-pti-on.cfg':
+			ensure => $grub_do_pti_on ? { true  => 'present', default => 'absent' },
+			content  => template('grub/puppet-kernel-pti-on.cfg.erb'),
+			notify  => Exec['update-grub']
+		}
 	}
 
 	exec { 'update-grub':