1

Is there an Ansible module that allows an SELinux context equivalence to be added? The command is:

semanage fcontext -a -e /home/xxx /srv/xxx

This makes SELinux treat /srv/xxx as equivalent to /home/xxx.

While I could use the command module, it only works once; after that it always fails with:

ValueError: Equivalence class for /srv/xxx already exists

I could use the shell module and run a command like:

semanage fcontext -a -e /home/xxx /srv/xxx || true

but since the command runs every time, Ansible always reports something has changed (even if the context equivalence already existed).

1
  • 1
    As temporary workaround you can use changed_when to avoid changed status in the shell module
    – ALex_hha
    Nov 15, 2020 at 19:12

1 Answer 1

2

Closest Ansible module to semanage fcontext is community.general.sefcontext. Looks like it is idempotent and supports diff mode.

However, no equilviant to --equal that I can find. Write the context you want as the setype parameter. For example, user_home_t. I would prefer the source of truth be the playbook in this case, not some other file on the host.

Should you want --equal, consider writing it yourself and submitting an enhancement pull request for the module.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .