You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ansible/test/integration/targets/module_utils_selinux/tasks/selinux.yml

94 lines
3.6 KiB
YAML

- name: collect selinux facts
setup:
gather_subset: ['!all', '!min', selinux]
register: fact_output
- debug:
var: fact_output
- name: create tempdir container in home
file:
path: ~/.selinux_tmp
state: directory
- name: create tempdir
tempfile:
path: ~/.selinux_tmp
prefix: selinux_test
state: directory
register: tempdir
- name: ls -1Zd tempdir to capture context from FS
shell: ls -1Zd '{{ tempdir.path }}'
register: tempdir_context_output
- name: create a file under the tempdir with no context info specified (it should inherit parent context)
file:
path: '{{ tempdir.path }}/file_inherited_context'
state: touch
register: file_inherited_context
- name: ls -1Z inherited file to capture context from FS
shell: ls -1Z '{{ tempdir.path }}/file_inherited_context'
register: inherited_context_output
- name: copy the file with explicit overrides on all context values
copy:
remote_src: yes
src: '{{ tempdir.path }}/file_inherited_context'
dest: '{{ tempdir.path }}/file_explicit_context'
seuser: system_u
serole: system_r
setype: user_tmp_t
# default configs don't have MLS levels defined, so we can't test that yet
# selevel: s1
register: file_explicit_context
- name: ls -1Z explicit file to capture context from FS
shell: ls -1Z '{{ tempdir.path }}/file_explicit_context'
register: explicit_context_output
- name: alter the tempdir context
file:
path: '{{ tempdir.path }}'
seuser: system_u
serole: system_r
setype: user_tmp_t
# default configs don't have MLS levels defined, so we can't test that yet
# selevel: s1
register: tempdir_altered
- name: ls -1Z tempdir to capture context from FS
shell: ls -1Z '{{ tempdir.path }}/file_explicit_context'
register: tempdir_altered_context_output
- name: copy the explicit context file with default overrides on all context values
copy:
remote_src: yes
src: '{{ tempdir.path }}/file_explicit_context'
dest: '{{ tempdir.path }}/file_default_context'
seuser: _default
serole: _default
setype: _default
selevel: _default
register: file_default_context
- name: see what matchpathcon thinks the context of default_file_context should be
shell: matchpathcon {{ file_default_context.dest }} | awk '{ print $2 }'
register: expected_default_context
- assert:
that:
- fact_output.ansible_facts.ansible_selinux.config_mode in ['enforcing','permissive']
- fact_output.ansible_facts.ansible_selinux.mode in ['enforcing','permissive']
- fact_output.ansible_facts.ansible_selinux.status == 'enabled'
- fact_output.ansible_facts.ansible_selinux_python_present == true
# assert that secontext is set on the file results (injected by basic.py, for better or worse)
- tempdir.secontext is match('.+:.+:.+') and tempdir.secontext in tempdir_context_output.stdout
- file_inherited_context.secontext is match('.+:.+:.+') and file_inherited_context.secontext in inherited_context_output.stdout
- file_inherited_context.secontext == tempdir.secontext # should've been inherited from the parent dir since not set explicitly
- file_explicit_context.secontext == 'system_u:system_r:user_tmp_t:s0' and file_explicit_context.secontext in explicit_context_output.stdout
- tempdir_altered.secontext == 'system_u:system_r:user_tmp_t:s0' and tempdir_altered.secontext in tempdir_altered_context_output.stdout
# the one with reset defaults should match the original tempdir context, not the altered one (ie, it was set by the original policy context, not inherited from the parent dir)
- file_default_context.secontext == expected_default_context.stdout_lines[0]