From 24b263c81227052bceaa468ac2175e7683ddeb1d Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Fri, 16 Apr 2021 11:37:18 -0400
Subject: [PATCH] only hold/unhold packages if not already unheld/held

---
 salt/salt/map.jinja  |  2 ++
 salt/salt/minion.sls | 15 +++++++++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/salt/salt/map.jinja b/salt/salt/map.jinja
index 3ba7194f5..5c1689e6c 100644
--- a/salt/salt/map.jinja
+++ b/salt/salt/map.jinja
@@ -3,8 +3,10 @@
 
 {% if grains.os == 'Ubuntu' %}
   {% set SPLITCHAR = '+' %}
+  {% set SALTNOTHELD = salt['cmd.run']('apt-mark showhold | grep salt-* ; echo $?') %}
 {% else %}
   {% set SPLITCHAR = '-' %}
+  {% set SALTNOTHELD = salt['cmd.run']('yum versionlock list | grep salt-* ; echo $?') %}
 {% endif %}
 
 {% set INSTALLEDSALTVERSION = salt['pkg.version']('salt-minion').split(SPLITCHAR)[0] %}
diff --git a/salt/salt/minion.sls b/salt/salt/minion.sls
index 1b0f7d901..5145da34b 100644
--- a/salt/salt/minion.sls
+++ b/salt/salt/minion.sls
@@ -1,6 +1,7 @@
 {% from 'salt/map.jinja' import UPGRADECOMMAND with context %}
 {% from 'salt/map.jinja' import SALTVERSION %}
 {% from 'salt/map.jinja' import INSTALLEDSALTVERSION %}
+{% from 'salt/map.jinja' import SALTNOTHELD %}
 {% import_yaml 'salt/minion.defaults.yaml' as SALTMINION %}
 {% set service_start_delay = SALTMINION.salt.minion.service_start_delay %}
 
@@ -8,11 +9,14 @@ include:
   - salt
   - systemd.reload
 
-{% if "{{INSTALLEDSALTVERSION}}" != "{{SALTVERSION}}" %}
+{% if INSTALLEDSALTVERSION|string != SALTVERSION|string %}
+
+{% if SALTNOTHELD == 0 %}
 unhold_salt_packages:
   module.run:
     - pkg.unhold:
-      - 'salt-*'
+      - name: 'salt-*'
+{% endif %}
 
 install_salt_minion:
   cmd.run:
@@ -23,11 +27,14 @@ install_salt_minion:
         nohup /bin/sh -c '{{ UPGRADECOMMAND }}' &
 {% endif %}
 
-{% if "{{INSTALLEDSALTVERSION}}" == "{{SALTVERSION}}" %}
+{% if INSTALLEDSALTVERSION|string == SALTVERSION|string %}
+
+{% if SALTNOTHELD == 1 %}
 hold_salt_packages:
   module.run:
     - pkg.hold:
-      - 'salt-*'
+      - name: 'salt-*'
+{% endif %}
 
 set_log_levels:
   file.append: