semanage fcontext in ansible?

Archives Ansible Developer
1

Hi,

I’ve got a playbook that needs to set some SELinux labels etc. And I’ve come up with two questions:

  1. So far I’ve used direct invocation of "semanage fcontext -a -t logwatch_cache_t “/var/lib/logwatch(/.*)?”. I have noticed that “file” module exposes some of the selinux labeling elements, however I’m having a rough time imagining how would I implement above invocation using file module…

file: dest=“/var/lib/logwatch(/.*)?” setype=logwatch_cache_t

  1. when using “file: … setype” - it seems nothing is stored in /etc/selinux/targeted/contexts/files/file_contexts.local afterwards. Thus shall I assume it’s more of a “chcon” front then “semanage fcontext” ?
2

(1) Yeah it’s not intended to apply wildcards. Logic here would be correct. Maybe could also just install a policy as an alternative?

(2) Yes:

https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/basic.py#L469

I’m open to possible additions.

3

I wrote a new module “sefcontext” to do exactly what “semanage fcontext” is intended for:

sefcontext:
target: ‘/var/lib/logwatch(/.*)?’
setype: logwatch_cache_t
state: present

It is fully idempotent, and supports check-mode and diff-mode.
It is constructed conform the already existing seport module.

The pull-request is available from: https://github.com/ansible/ansible-modules-extras/pull/2221