diff --git a/changelogs/fragments/496_seboolean-make-it-wrk-with-SELinux-disabled.yaml b/changelogs/fragments/496_seboolean-make-it-wrk-with-SELinux-disabled.yaml new file mode 100644 index 0000000..e14cfa6 --- /dev/null +++ b/changelogs/fragments/496_seboolean-make-it-wrk-with-SELinux-disabled.yaml @@ -0,0 +1,3 @@ +--- +bugfixes: + - seboolean - make it work with disabled SELinux diff --git a/plugins/modules/seboolean.py b/plugins/modules/seboolean.py index 0d23073..1e73aef 100644 --- a/plugins/modules/seboolean.py +++ b/plugins/modules/seboolean.py @@ -73,8 +73,7 @@ except ImportError: HAVE_SEMANAGE = False from ansible.module_utils.basic import AnsibleModule, missing_required_lib -from ansible.module_utils.six import binary_type -from ansible.module_utils._text import to_bytes, to_text +from ansible.module_utils._text import to_text from ansible_collections.ansible.posix.plugins.module_utils._respawn import respawn_module, HAS_RESPAWN_UTIL @@ -82,23 +81,6 @@ def get_runtime_status(ignore_selinux_state=False): return True if ignore_selinux_state is True else selinux.is_selinux_enabled() -def has_boolean_value(module, name): - bools = [] - try: - rc, bools = selinux.security_get_boolean_names() - except OSError: - module.fail_json(msg="Failed to get list of boolean names") - # work around for selinux who changed its API, see - # https://github.com/ansible/ansible/issues/25651 - if len(bools) > 0: - if isinstance(bools[0], binary_type): - name = to_bytes(name) - if name in bools: - return True - else: - return False - - def get_boolean_value(module, name): state = 0 try: @@ -174,7 +156,10 @@ def semanage_set_boolean_value(module, handle, name, value): semanage.semanage_handle_destroy(handle) module.fail_json(msg="Failed to modify boolean key with semanage") - if semanage.semanage_bool_set_active(handle, boolkey, sebool) < 0: + if ( + selinux.is_selinux_enabled() + and semanage.semanage_bool_set_active(handle, boolkey, sebool) < 0 + ): semanage.semanage_handle_destroy(handle) module.fail_json(msg="Failed to set boolean key active with semanage") @@ -315,12 +300,9 @@ def main(): # Feature only available in selinux library since 2012. name = selinux.selinux_boolean_sub(name) - if not has_boolean_value(module, name): - module.fail_json(msg="SELinux boolean %s does not exist." % name) - if persistent: changed = semanage_boolean_value(module, name, state) - else: + elif selinux.is_selinux_enabled(): cur_value = get_boolean_value(module, name) if cur_value != state: changed = True