selinux: state=disabled

Archives Ansible Developer
1

Currently if SELinux is enabled on the system and if you run a task:

`

  • selinux: state=disabled
    `

it will set SELinux as disabled in the conf file, but SELinux itself will still be enabled (in enforcing by default) until the system is rebooted, which basically means SELinux is not disabled after this task runs. Also re-running this task again before the server is rebooted, it will report as changed, even though we set SELinux as disabled before.

I can understand the changed problem before rebooting, but I can’t understand leaving enforcing after this. I think it would be better to change the module to set the config to disabled and run setenforce 0 to set the permissive mode as well. Currently state=disabled is useless without a restart.

I wanted to ask here what do you think before making an issue on GitHub.

2

Hi Strahinja,

I think that makes sense, so feel free to open that issue.

Thanks!

3

I made a pull request https://github.com/ansible/ansible/pull/9072