From 2f198ed9fb8b5646e469432fbdf6dac47d17abea Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 15 Apr 2021 09:42:00 -0400
Subject: [PATCH] change how salt is held and unheld from updates

---
 salt/salt/map.jinja  | 14 +++-----------
 salt/salt/minion.sls | 24 +++++++++++++-----------
 2 files changed, 16 insertions(+), 22 deletions(-)

diff --git a/salt/salt/map.jinja b/salt/salt/map.jinja
index 6b5273b84..67742812b 100644
--- a/salt/salt/map.jinja
+++ b/salt/salt/map.jinja
@@ -1,5 +1,6 @@
 {% import_yaml 'salt/minion.defaults.yaml' as saltminion %}
 {% set SALTVERSION = saltminion.salt.minion.version %}
+{% set INSTALLEDSALTVERSION = salt['pkg.version']('salt-minion').split(SPLITCHAR)[0] %}
 
 {% if grains.os == 'Ubuntu' %}
   {% set SPLITCHAR = '+' %}
@@ -7,20 +8,11 @@
   {% set SPLITCHAR = '-' %}
 {% endif %}
 
-{% set INSTALLEDSALTVERSION = salt['pkg.version']('salt-minion').split(SPLITCHAR)[0] %}
-{% set ISAIRGAP = salt['pillar.get']('global:airgap', 'False') %}
-
-{% if grains.os|lower == 'ubuntu' %}
-  {% set COMMON = 'salt-common' %}
-{% elif grains.os|lower in ['centos', 'redhat'] %}
-  {% set COMMON = 'salt' %}
-{% endif %}
-
 {% if grains.saltversion|string != SALTVERSION|string %}
   {% if grains.os|lower in ['centos', 'redhat'] %}
-      {% set UPGRADECOMMAND = 'yum clean all ; yum versionlock delete "salt-*" && /usr/sbin/bootstrap-salt.sh -X -s 120 -r -F -x python3 stable ' ~ SALTVERSION ~ ' ; yum versionlock add "salt-*"' %}
+      {% set UPGRADECOMMAND = 'yum clean all ; /usr/sbin/bootstrap-salt.sh -X -s 120 -r -F -x python3 stable ' ~ SALTVERSION ~ ' && yum versionlock add "salt-*"' %}
   {% elif grains.os|lower == 'ubuntu' %}
-    {% set UPGRADECOMMAND = 'apt-mark unhold salt-common ; apt-mark unhold salt-minion && /usr/sbin/bootstrap-salt.sh -X -s 120 -F -x python3 stable ' ~ SALTVERSION ~ ' ; apt-mark hold salt-common && apt-mark hold salt-minion' %}
+    {% set UPGRADECOMMAND = '/usr/sbin/bootstrap-salt.sh -X -s 120 -F -x python3 stable ' ~ SALTVERSION ~ ' && apt-mark hold salt-common && apt-mark hold salt-minion' %}
   {% endif %}
 {% else %}
   {% set UPGRADECOMMAND = 'echo Already running Salt Minion version ' ~ SALTVERSION %}
diff --git a/salt/salt/minion.sls b/salt/salt/minion.sls
index 1c7f1a5e8..6488124f6 100644
--- a/salt/salt/minion.sls
+++ b/salt/salt/minion.sls
@@ -9,6 +9,12 @@ include:
   - salt
   - systemd.reload
 
+{% if "{{INSTALLEDSALTVERSION}}" != "{{SALTVERSION}}" %}
+unhold_salt_packages:
+  module.run:
+    - pkg.unhold:
+      - 'salt-*'
+
 install_salt_minion:
   cmd.run:
     - name: |
@@ -16,15 +22,13 @@ install_salt_minion:
         exec 1>&- # close stdout
         exec 2>&- # close stderr
         nohup /bin/sh -c '{{ UPGRADECOMMAND }}' &
-    - onlyif: test "{{INSTALLEDSALTVERSION}}" != "{{SALTVERSION}}"
+{% endif %}
 
-salt_minion_package:
-  pkg.installed:
-    - pkgs:
-      - {{ COMMON }}
-      - salt-minion
-    - hold: True
-    - onlyif: test "{{INSTALLEDSALTVERSION}}" == "{{SALTVERSION}}"
+{% if "{{INSTALLEDSALTVERSION}}" == "{{SALTVERSION}}" %}
+hold_salt_packages:
+  module.run:
+    - pkg.hold:
+      - 'salt-*'
 
 set_log_levels:
   file.append:
@@ -46,11 +50,9 @@ salt_minion_service_unit_file:
       - module: systemd_reload
     - listen_in:
       - service: salt_minion_service
-    - onlyif: test "{{INSTALLEDSALTVERSION}}" == "{{SALTVERSION}}"
 
 salt_minion_service:
   service.running:
     - name: salt-minion
     - enable: True
-    - onlyif: test "{{INSTALLEDSALTVERSION}}" == "{{SALTVERSION}}"
-
+{% endif %}