Replace SELinux community module with LSR #303
Conversation
.ansible-lint
Outdated
| - community.general.yum_versionlock | ||
| - community.general.rhsm_repository | ||
| - ansible.posix.selinux | ||
| - redhat.rhel_system_roles.selinux |
There was a problem hiding this comment.
| - redhat.rhel_system_roles.selinux |
We cannot use the module. We must use the role.
There was a problem hiding this comment.
For selinux yes, we should use the role to ensure that selinux is properly configured. I guess it makes sense to use fedora.linux_system_roles.selinux role in the upstream. We will change this in RPM spec for downstream.
How about ansible.posix.mount? Downstream, is it a good idea to use redhat.rhel_system_roles.mount to avoid re-vendoring it?
There was a problem hiding this comment.
For selinux yes, we should use the role to ensure that selinux is properly configured. I guess it makes sense to use fedora.linux_system_roles.selinux role in the upstream. We will change this in RPM spec for downstream.
How about
ansible.posix.mount? Downstream, is it a good idea to useredhat.rhel_system_roles.mountto avoid re-vendoring it?
That one will be problematic. Yes, there is a fedora.linux_system_roles.mount module used internally by a couple of roles - but this is only meant to be used internally by the role, not by code outside of the role. We do not want to support using modules, even if it is for "friendly" external code.
Maybe there is a way we can use the storage role, not sure.
tomasfratrik
force-pushed
the
use-rhel-selinux-module
branch
from
d28a4ff to
103f747
Compare
tomasfratrik
changed the title
|
lgtm - you will need a changelog fragment |
Part of: Jira: RHEL-120542
tomasfratrik
force-pushed
the
use-rhel-selinux-module
branch
from
103f747 to
ba40f1f
Compare
Added, but I am not sure about conventions here |
|
[citest] |
| reboot_timeout: "{{ reboot_timeout }}" | ||
| post_reboot_delay: "{{ post_reboot_delay }}" | ||
| timeout: "{{ reboot_timeout }}" | ||
| when: selinux_results.reboot_required |
There was a problem hiding this comment.
Does selinux role return a reboot_required variable? That might not be applicable to the role.
There was a problem hiding this comment.
yes you are right, according the documentation it should be selinux_reboot_required
| selinux_state: "{{ selinux_mode }}" | ||
| check_mode: true | ||
| register: selinux_check_results | ||
| failed_when: selinux_check_results.changed |
There was a problem hiding this comment.
include_role might not return changed variable
There was a problem hiding this comment.
Correct. It does not return changed
There was a problem hiding this comment.
in fact - you cannot use check_mode, register, or failed_when with include_role
| vars: | ||
| selinux_policy: targeted | ||
| selinux_state: "{{ selinux_mode }}" | ||
| register: selinux_results |
There was a problem hiding this comment.
register does not work with include_role
There was a problem hiding this comment.
yes I have now realised that now its for include_role
|
This example explains how to use the selinux role when there is the possibility that the system needs to be rebooted to apply the changes: https://github.com/linux-system-roles/selinux/blob/main/examples/selinux-playbook.yml
|
3 participants
For now this is just a draft, Im not sure if we want PR for each module, or all modules in 1 PR.
Part of:
Jira: RHEL-120542