From 213cbfcdb5352e523ad2652e00fb63dacff2d57c Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 21 Sep 2023 14:56:06 +0200 Subject: [PATCH 1/2] seboolean: make it work with disabled SELinux Sometimes it's necessary to configure SELinux before it's enabled on the system. There's `ignore_selinux_state` which should allow it. Before this change `seboolean` module failed on SELinux disabled system even with `ignore_selinux_state: true` and SELinux policy installed while `semanage boolean` worked as expected: $ ansible -i 192.168.121.153, -m seboolean -a "name=ssh_sysadm_login state=on ignore_selinux_state=true" all 192.168.121.153 | FAILED! => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python3" }, "changed": false, "msg": "Failed to get list of boolean names" } $ ssh root@192.168.121.153 semanage boolean -l | grep ssh_sysadm_login ssh_sysadm_login (off , off) Allow ssh to sysadm login It's caused by `selinux.security_get_boolean_names()` and `selinux.security_get_boolean_active(name)` which required SELinux enabled system. This change adds a fallback to semanage API which works in SELinux disabled system when SELinux targeted policy is installed: ANSIBLE_LIBRARY=plugins/modules ansible -i 192.168.121.153, -m seboolean -a "name=ssh_sysadm_login state=on persistent=true ignore_selinux_state=true" all 192.168.121.153 | CHANGED => { "ansible_facts": { "discovered_interpreter_python": "/usr/bin/python3" }, "changed": true, "name": "ssh_sysadm_login", "persistent": true, "state": true } $ ssh root@192.168.121.153 semanage boolean -l | grep ssh_sysadm_login ssh_sysadm_login (on , on) Allow ssh to sysadm login Note that without `persistent=true` this module is effectively NO-OP now. Signed-off-by: Petr Lautrbach --- plugins/modules/seboolean.py | 27 +++++---------------------- 1 file changed, 5 insertions(+), 22 deletions(-) diff --git a/plugins/modules/seboolean.py b/plugins/modules/seboolean.py index 657b7fa..1fea4ea 100644 --- a/plugins/modules/seboolean.py +++ b/plugins/modules/seboolean.py @@ -81,23 +81,6 @@ def get_runtime_status(ignore_selinux_state=False): return True if ignore_selinux_state is True else selinux.is_selinux_enabled() -def has_boolean_value(module, name): - bools = [] - try: - rc, bools = selinux.security_get_boolean_names() - except OSError: - module.fail_json(msg="Failed to get list of boolean names") - # work around for selinux who changed its API, see - # https://github.com/ansible/ansible/issues/25651 - if len(bools) > 0: - if isinstance(bools[0], binary_type): - name = to_bytes(name) - if name in bools: - return True - else: - return False - - def get_boolean_value(module, name): state = 0 try: @@ -173,7 +156,10 @@ def semanage_set_boolean_value(module, handle, name, value): semanage.semanage_handle_destroy(handle) module.fail_json(msg="Failed to modify boolean key with semanage") - if semanage.semanage_bool_set_active(handle, boolkey, sebool) < 0: + if ( + selinux.is_selinux_enabled() + and semanage.semanage_bool_set_active(handle, boolkey, sebool) < 0 + ): semanage.semanage_handle_destroy(handle) module.fail_json(msg="Failed to set boolean key active with semanage") @@ -308,12 +294,9 @@ def main(): # Feature only available in selinux library since 2012. name = selinux.selinux_boolean_sub(name) - if not has_boolean_value(module, name): - module.fail_json(msg="SELinux boolean %s does not exist." % name) - if persistent: changed = semanage_boolean_value(module, name, state) - else: + elif selinux.is_selinux_enabled(): cur_value = get_boolean_value(module, name) if cur_value != state: changed = True From 1328ef0c0aa892a53e7c8e8cbc924889ef2bb681 Mon Sep 17 00:00:00 2001 From: Petr Lautrbach Date: Thu, 21 Sep 2023 16:52:45 +0200 Subject: [PATCH 2/2] Add a changelog fragment --- .../496_seboolean-make-it-wrk-with-SELinux-disabled.yaml | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 changelogs/fragments/496_seboolean-make-it-wrk-with-SELinux-disabled.yaml diff --git a/changelogs/fragments/496_seboolean-make-it-wrk-with-SELinux-disabled.yaml b/changelogs/fragments/496_seboolean-make-it-wrk-with-SELinux-disabled.yaml new file mode 100644 index 0000000..e14cfa6 --- /dev/null +++ b/changelogs/fragments/496_seboolean-make-it-wrk-with-SELinux-disabled.yaml @@ -0,0 +1,3 @@ +--- +bugfixes: + - seboolean - make it work with disabled SELinux