# semanage fcontext in ansible?

**URL:** <https://forum.ansible.com/t/semanage-fcontext-in-ansible/16688>\
**Category:** Ansible Developer\
**Created:** [November 4, 2014, 3:49pm UTC](https://forum.ansible.com/t/semanage-fcontext-in-ansible/16688 "2014-11-04T15:49:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dimon](https://avatars.discourse-cdn.com/v4/letter/d/eb8c5e/32.png) [@Dimon](https://forum.ansible.com/u/Dimon)\
**Post date:** [November 4, 2014, 3:49pm UTC](https://forum.ansible.com/t/semanage-fcontext-in-ansible/16688/1 "2014-11-04T15:49:35Z")

</div>

Hi,

I’ve got a playbook that needs to set some SELinux labels etc. And I’ve come up with two questions:

1. So far I’ve used direct invocation of "semanage fcontext -a -t logwatch\_cache\_t “/var/lib/logwatch(/.\*)?”. I have noticed that “file” module exposes some of the selinux labeling elements, however I’m having a rough time imagining how would I implement above invocation using file module…

file: dest=“/var/lib/logwatch(/.\*)?” setype=logwatch\_cache\_t

1. when using “file: … setype” - it seems nothing is stored in /etc/selinux/targeted/contexts/files/file\_contexts.local afterwards. Thus shall I assume it’s more of a “chcon” front then “semanage fcontext” ?

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [November 4, 2014, 9:21pm UTC](https://forum.ansible.com/t/semanage-fcontext-in-ansible/16688/2 "2014-11-04T21:21:24Z")

</div>

(1) Yeah it’s not intended to apply wildcards. Logic here would be correct. Maybe could also just install a policy as an alternative?

(2) Yes:

[https://github.com/ansible/ansible/blob/devel/lib/ansible/module\_utils/basic.py#L469](https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/basic.py#L469)

I’m open to possible additions.

---

<div class="post-metadata">

**Author:** ![Dag\_Wieers](https://avatars.discourse-cdn.com/v4/letter/d/45deac/32.png) [@Dag\_Wieers](https://forum.ansible.com/u/Dag_Wieers)\
**Post date:** [May 13, 2016, 2:45pm UTC](https://forum.ansible.com/t/semanage-fcontext-in-ansible/16688/3 "2016-05-13T14:45:28Z")

</div>

I wrote a new module “sefcontext” to do exactly what “semanage fcontext” is intended for:

sefcontext:  
target: ‘/var/lib/logwatch(/.\*)?’  
setype: logwatch\_cache\_t  
state: present

It is fully idempotent, and supports check-mode and diff-mode.  
It is constructed conform the already existing seport module.

The pull-request is available from: [https://github.com/ansible/ansible-modules-extras/pull/2221](https://github.com/ansible/ansible-modules-extras/pull/2221)