diff --git a/changelogs/fragments/85542-warning-when-using-seuser-on-alpine.yml b/changelogs/fragments/85542-warning-when-using-seuser-on-alpine.yml new file mode 100644 index 00000000000..b32ff161936 --- /dev/null +++ b/changelogs/fragments/85542-warning-when-using-seuser-on-alpine.yml @@ -0,0 +1,2 @@ +bugfixes: + - user - The seuser parameter will be ignored on Alpine and print a warning (https://github.com/ansible/ansible/issues/85542). \ No newline at end of file diff --git a/lib/ansible/modules/user.py b/lib/ansible/modules/user.py index b81258153fd..24b04b28412 100644 --- a/lib/ansible/modules/user.py +++ b/lib/ansible/modules/user.py @@ -44,6 +44,7 @@ options: seuser: description: - Optionally sets the C(seuser) type C(user_u) on SELinux enabled systems. + - This parameter will be ignored on macOS, *BSD, BusyBox-based distros and Buildroot. type: str version_added: "2.1" group: @@ -1345,6 +1346,12 @@ class User(object): return None return ssh_public_key + def check_seuser_support(self): + # Now only Generic platform supports the seuser parameter + if self.platform != 'Generic': + self.module.warn(f"The 'seuser' parameter is not supported on {self.distribution or self.platform} " + "as it lacks SELinux support and has been ignored.") + def create_user(self): # by default we use the create_user_useradd method return self.create_user_useradd() @@ -3355,6 +3362,9 @@ def main(): if not os.path.isdir(parent): path_needs_parents = True + if user.seuser: + user.check_seuser_support() + (rc, out, err) = user.create_user() # If the home path had parent directories that needed to be created, diff --git a/test/integration/targets/user/tasks/main.yml b/test/integration/targets/user/tasks/main.yml index 6a3c84eecd7..4af35b28b2a 100644 --- a/test/integration/targets/user/tasks/main.yml +++ b/test/integration/targets/user/tasks/main.yml @@ -34,3 +34,6 @@ - ansible_facts.system == 'Linux' - ansible_distribution != 'Alpine' - import_tasks: ssh_keygen.yml +- import_tasks: test_seuser.yml + when: + - ansible_facts.system in ['FreeBSD', 'OpenBSD', 'Darwin'] or ansible_distribution == 'Alpine' diff --git a/test/integration/targets/user/tasks/test_seuser.yml b/test/integration/targets/user/tasks/test_seuser.yml new file mode 100644 index 00000000000..67d34c53596 --- /dev/null +++ b/test/integration/targets/user/tasks/test_seuser.yml @@ -0,0 +1,16 @@ +- name: Try creating user with nonexistent SELinux user + user: + name: badseuser + seuser: nonexistent_u + state: present + register: test_seuser + +- name: there should be warnings + assert: + that: test_seuser.warnings[0] is contains "lacks SELinux support" + +- name: Cleanup test account + user: + name: badseuser + state: absent + remove: yes \ No newline at end of file