linux-system-roles/selinux 1.0.0

on GitHub

Notable Changes

Note that the changes are not backward compatible and it is necessary to update playbooks that use them.

• The following variables have been renamed according to common conventions and to improve consistency with the selinux module:

  • SELinux_type to selinux_policy
  • SELinux_mode to selinux_state
  • SELinux_booleans to selinux_booleans
  • SELinux_file_contexts to selinux_file_contexts
  • SELinux_restore_dirs to selinux_restore_dirs
  • SELinux_ports to selinux_ports
  • SELinux_logins to selinux_logins

• The selinux_change_running variable was removed without a functional change, as the role has been always changing the running state and the variable was effectively ignored.

• Local modifications to file contexts, ports, logins, and booleans are no longer dropped by default. The modifications specified in selinux_booleans, selinux_file_contexts, selinux_ports and selinux_logins are applied on top of pre-existing modifications. To obtain the previous behavior, set the new variables selinux_booleans_purge, selinux_fcontexts_purge, selinux_ports_purge and selinux_logins_purge (or just selinux_all_purge) toTrue.

• Dictionaries that are passed to the selinux_file_contexts variable now provide the new state option, which is set to present by default. Setting it to absent drops individual modifications to file contexts.

• If the selinux_state or selinux_policy variables are not defined, the selinux role preserves previous values. Only if the SELinux policy is not defined on the system and SELinux is enabled by the role, selinux_policy defaults to targeted.

• Behavior in cases when a reboot is needed to apply the settings has been redefined. The selinux role now fails with an explanatory error message and sets the selinux_reboot_required custom fact to True. The role never reboots the managed host itself. The error needs to be handled in the playbook by using the block directive, and after rebooting the system, the role needs to be applied again. An example is shown in the provided selinux-playbook.yml playbook.