# Ansible and SELinux Issues

**URL:** <https://forum.ansible.com/t/ansible-and-selinux-issues/36075>\
**Category:** Ansible Project\
**Tags:** rhel\
**Created:** [December 6, 2021, 2:59pm UTC](https://forum.ansible.com/t/ansible-and-selinux-issues/36075 "2021-12-06T14:59:26Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ryan\_P](https://avatars.discourse-cdn.com/v4/letter/r/85e7bf/32.png) [@Ryan\_P](https://forum.ansible.com/u/Ryan_P)\
**Post date:** [December 6, 2021, 2:59pm UTC](https://forum.ansible.com/t/ansible-and-selinux-issues/36075/1 "2021-12-06T14:59:26Z")

</div>

Hi all,

My Ansible server has lost the ability to login to any of my hosts (itself included) and I am hoping others have had a similar issue.

The server in question is a RHEL7 server that is required to be configured according to the DISA STIG. In particular, after implementing RHEL-07-020023 - which requires administrative groups in sudoers to have the sysadm\_r and sysadm\_t role applied, Ansible completely loses its ability to log into the hosts. The error is as follows:

Permission denied:  
unix\_listener: cannot bind to path: /root/.ansible/cp/

When switching back to unconfined\_r and unconfined\_t, Ansible works as expected.

Unfortunately I’m not able to dispute with my security department as to why the sysadm context is a just a drunken version of the unconfined context, so if anyone has any suggestions I would be extremely grateful.

- Ryan P

---

<div class="post-metadata">

**Author:** ![dan\_linder](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/dan_linder/32/3833_2.png) [@dan\_linder](https://forum.ansible.com/u/dan_linder)\
**Post date:** [December 9, 2021, 11:59pm UTC](https://forum.ansible.com/t/ansible-and-selinux-issues/36075/2 "2021-12-09T23:59:21Z")

</div>

In my environment, I found that we had to add the “remote\_tmp” variable and make it unique per user. I think you’re running into the same thing if you look at the error message from that point of view:

Permission denied:

unix\_listener: **cannot bind to path: /root** /.ansible/cp/

If it’s the same issue I experienced, adding this to my user (or service account) “.ansible.cfg” file helped:

[defaults]

remote\_tmp = /tmp/ansible.${USER}

And yes, that is a literal “${USER}” in the path - when the remote machine sets the variable it is expanded to the user account that Ansible connected as.

Dan