mirror of https://github.com/ansible/ansible.git
This reverts commit bd9e31fcb0.
pull/81121/head
parent
82b5544b09
commit
7e2b25beac
@ -1,22 +0,0 @@
|
|||||||
# ansible-podman selinux module
|
|
||||||
|
|
||||||
On Fedora-derived systems (and possibly others), selinux can prevent podman
|
|
||||||
from running the way we need it to for our tests to work.
|
|
||||||
|
|
||||||
Loading this module (hopefully) allows you to
|
|
||||||
[keep selinux enabled](https://stopdisablingselinux.com/) and still be able to
|
|
||||||
run our tests.
|
|
||||||
|
|
||||||
To use it, just run:
|
|
||||||
|
|
||||||
```
|
|
||||||
./build.sh
|
|
||||||
```
|
|
||||||
|
|
||||||
...which will build the module. Then run:
|
|
||||||
|
|
||||||
```
|
|
||||||
sudo semodule -i ansible-podman.pp
|
|
||||||
```
|
|
||||||
|
|
||||||
to insert and enable the module.
|
|
||||||
@ -1,17 +0,0 @@
|
|||||||
module ansible-podman 1.0;
|
|
||||||
|
|
||||||
require {
|
|
||||||
type container_t;
|
|
||||||
type cgroup_t;
|
|
||||||
type fusefs_t;
|
|
||||||
class dir { add_name create remove_name rmdir write };
|
|
||||||
class file { create relabelto write };
|
|
||||||
class bpf map_create;
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
allow container_t cgroup_t:dir { add_name create remove_name rmdir write };
|
|
||||||
|
|
||||||
allow container_t cgroup_t:file { create write };
|
|
||||||
allow container_t fusefs_t:file relabelto;
|
|
||||||
allow container_t self:bpf map_create;
|
|
||||||
@ -1,9 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
set -x
|
|
||||||
set -e
|
|
||||||
checkmodule -Mmo ansible-podman.mod ansible-podman.te
|
|
||||||
semodule_package -o ansible-podman.pp -m ansible-podman.mod
|
|
||||||
|
|
||||||
set +x
|
|
||||||
echo "Module built. Now run this as root:"
|
|
||||||
echo "semodule -i $(pwd)/ansible-podman.pp"
|
|
||||||
Loading…
Reference in New Issue