# wrong SELinux security contexts **URL:** \ **Category:** Ansible Project\ **Created:** [July 18, 2013, 10:20am UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151 "2013-07-18T10:20:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Filip\_Slunecko](https://avatars.discourse-cdn.com/v4/letter/f/58956e/32.png) [@Filip\_Slunecko](https://forum.ansible.com/u/Filip_Slunecko)\ **Post date:** [July 18, 2013, 10:20am UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/1 "2013-07-18T10:20:53Z")
Hi, This command: - name: create file httpd.conf template: src=httpd.conf dest=/etc/httpd/conf/httpd.conf owner=root group=root mode=0644 create the httpd.conf file with wrong security contexts. unconfined\_u:object\_r:admin\_home\_t:s0 httpd.conf I am using a version from git. Thanks, Filip ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 18, 2013, 11:46am UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/2 "2013-07-18T11:46:07Z")
Check and see if you have libselinux-python installed please and let us know what version of Ansbile you are using. We need to increase error handling (i.e. not continuing to manage files until it is installed) when libselinux-python is missing. ---
**Author:** ![Filip\_Slunecko](https://avatars.discourse-cdn.com/v4/letter/f/58956e/32.png) [@Filip\_Slunecko](https://forum.ansible.com/u/Filip_Slunecko)\ **Post date:** [July 18, 2013, 1:09pm UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/3 "2013-07-18T13:09:47Z")
Nope libselinux-python is not installed on the node. Version is latest from the git. Filip ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [July 18, 2013, 1:45pm UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/4 "2013-07-18T13:45:03Z")
that is required on targets for selinux related functions to work. ---
**Author:** ![Filip\_Slunecko](https://avatars.discourse-cdn.com/v4/letter/f/58956e/32.png) [@Filip\_Slunecko](https://forum.ansible.com/u/Filip_Slunecko)\ **Post date:** [July 18, 2013, 3:41pm UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/5 "2013-07-18T15:41:31Z")
I have added libselinux-python and it works. Thanks ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 18, 2013, 4:06pm UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/6 "2013-07-18T16:06:44Z")
Yeah, great. I am going to look into making this raise proper errors and when not installed on the remotes (and all you to therefore install it). Thanks! ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [July 19, 2013, 2:01am UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/7 "2013-07-19T02:01:00Z")
so for those who know selinux better than I and/or have systems to test, I’m floating the following patch: diff --git a/lib/ansible/module\_common.py b/lib/ansible/module\_common.py index d61e2aa…1bdbc9e 100644 — a/lib/ansible/module\_common.py +++ b/lib/ansible/module\_common.py @@ -265,6 +265,11 @@ class AnsibleModule(object): def selinux\_enabled(self): if not HAVE\_SELINUX: - sestatus = get\_bin\_path(‘sestatus’) - if sestatus is not None: - (rc,out,err) = run\_command(sestatus) - if rc == 0 and re.search(‘enabled’, out): - self.fail\_json(path=path, msg=“Aborting, target uses selinux but python bindings (python-selinux) aren’t installed!”) return False if selinux.is\_selinux\_enabled() == 1: return True ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [July 19, 2013, 3:51am UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/8 "2013-07-19T03:51:46Z")
This seems sufficient for me, it would only cause failures for things about to do something SELinuxey\* fn 1) For those unaware, AC/DC’s “for those about rock” was originally titled “for those about to do something SELinuxey”. ---
**Author:** ![Stephen\_Fromm](https://avatars.discourse-cdn.com/v4/letter/s/bbce88/32.png) [@Stephen\_Fromm](https://forum.ansible.com/u/Stephen_Fromm)\ **Post date:** [July 19, 2013, 4:24am UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/9 "2013-07-19T04:24:49Z")
An alternative to sestatus is to call selinuxenabled. If selinux is enabled, it exits with rc 0. Otherwise, it exits with rc 1. The man page selinuxenabled(1) describes it as a 'tool to be used within shell scripts to determine if selinux is enabled'. I think this would be preferable to parsing output from sestatus, which I know has 'evolved' over time. ☹ Regards, sf ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [July 19, 2013, 4:51am UTC](https://forum.ansible.com/t/wrong-selinux-security-contexts/13151/10 "2013-07-19T04:51:47Z")
Looks much better, will patch patch. Brian Coca