Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .ansible-lint
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ mock_modules:
- community.general.archive
- community.general.yum_versionlock
- community.general.rhsm_repository
- ansible.posix.selinux
- fedora.linux_system_roles.selinux
- ansible.posix.mount

# mock_roles:
Expand Down
4 changes: 4 additions & 0 deletions changelogs/fragments/303-replace-selinux-module.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
---
minor_changes:
- Replace SELinux community module with Linux System Role.
...
16 changes: 10 additions & 6 deletions roles/upgrade/tasks/leapp-post-upgrade-selinux.yml
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,11 @@
# failed_when: ausearch_results.stdout != "<no matches>"

- name: leapp-post-upgrade-selinux | SELinux mode is set to {{ selinux_mode }}
ansible.posix.selinux:
policy: targeted
state: "{{ selinux_mode }}"
ansible.builtin.include_role:
name: fedora.linux_system_roles.selinux
vars:
selinux_policy: targeted
selinux_state: "{{ selinux_mode }}"
register: selinux_results
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

register does not work with include_role

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes I have now realised that now its for include_role


- name: leapp-post-upgrade-selinux | Reboot when required for SELinux change
Expand All @@ -22,9 +24,11 @@
when: selinux_results.reboot_required
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does selinux role return a reboot_required variable? That might not be applicable to the role.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes you are right, according the documentation it should be selinux_reboot_required


- name: leapp-post-upgrade-selinux | Verify SELinux is set to {{ selinux_mode }}
ansible.posix.selinux:
policy: targeted
state: "{{ selinux_mode }}"
ansible.builtin.include_role:
name: fedora.linux_system_roles.selinux
vars:
selinux_policy: targeted
selinux_state: "{{ selinux_mode }}"
check_mode: true
register: selinux_check_results
failed_when: selinux_check_results.changed
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

include_role might not return changed variable

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct. It does not return changed

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in fact - you cannot use check_mode, register, or failed_when with include_role

Expand Down