94 lines
3.6 KiB
YAML
94 lines
3.6 KiB
YAML
|
- name: collect selinux facts
|
||
|
|
setup:
|
||
|
|
gather_subset: ['!all', '!min', selinux]
|
||
|
|
register: fact_output
|
||
|
|
|
||
|
|
- debug:
|
||
|
|
var: fact_output
|
||
|
|
|
||
|
|
- name: create tempdir container in home
|
||
|
|
file:
|
||
|
|
path: ~/.selinux_tmp
|
||
|
|
state: directory
|
||
|
|
|
||
|
|
- name: create tempdir
|
||
|
|
tempfile:
|
||
|
|
path: ~/.selinux_tmp
|
||
|
|
prefix: selinux_test
|
||
|
|
state: directory
|
||
|
|
register: tempdir
|
||
|
|
|
||
|
|
- name: ls -1Zd tempdir to capture context from FS
|
||
|
|
shell: ls -1Zd '{{ tempdir.path }}'
|
||
|
|
register: tempdir_context_output
|
||
|
|
|
||
|
|
- name: create a file under the tempdir with no context info specified (it should inherit parent context)
|
||
|
|
file:
|
||
|
|
path: '{{ tempdir.path }}/file_inherited_context'
|
||
|
|
state: touch
|
||
|
|
register: file_inherited_context
|
||
|
|
|
||
|
|
- name: ls -1Z inherited file to capture context from FS
|
||
|
|
shell: ls -1Z '{{ tempdir.path }}/file_inherited_context'
|
||
|
|
register: inherited_context_output
|
||
|
|
|
||
|
|
- name: copy the file with explicit overrides on all context values
|
||
|
|
copy:
|
||
|
|
remote_src: yes
|
||
|
|
src: '{{ tempdir.path }}/file_inherited_context'
|
||
|
|
dest: '{{ tempdir.path }}/file_explicit_context'
|
||
|
|
seuser: system_u
|
||
|
|
serole: system_r
|
||
|
|
setype: user_tmp_t
|
||
|
|
# default configs don't have MLS levels defined, so we can't test that yet
|
||
|
|
# selevel: s1
|
||
|
|
register: file_explicit_context
|
||
|
|
|
||
|
|
- name: ls -1Z explicit file to capture context from FS
|
||
|
|
shell: ls -1Z '{{ tempdir.path }}/file_explicit_context'
|
||
|
|
register: explicit_context_output
|
||
|
|
|
||
|
|
- name: alter the tempdir context
|
||
|
|
file:
|
||
|
|
path: '{{ tempdir.path }}'
|
||
|
|
seuser: system_u
|
||
|
|
serole: system_r
|
||
|
|
setype: user_tmp_t
|
||
|
|
# default configs don't have MLS levels defined, so we can't test that yet
|
||
|
|
# selevel: s1
|
||
|
|
register: tempdir_altered
|
||
|
|
|
||
|
|
- name: ls -1Z tempdir to capture context from FS
|
||
|
|
shell: ls -1Z '{{ tempdir.path }}/file_explicit_context'
|
||
|
|
register: tempdir_altered_context_output
|
||
|
|
|
||
|
|
- name: copy the explicit context file with default overrides on all context values
|
||
|
|
copy:
|
||
|
|
remote_src: yes
|
||
|
|
src: '{{ tempdir.path }}/file_explicit_context'
|
||
|
|
dest: '{{ tempdir.path }}/file_default_context'
|
||
|
|
seuser: _default
|
||
|
|
serole: _default
|
||
|
|
setype: _default
|
||
|
|
selevel: _default
|
||
|
|
register: file_default_context
|
||
|
|
|
||
|
|
- name: see what matchpathcon thinks the context of default_file_context should be
|
||
|
|
shell: matchpathcon {{ file_default_context.dest }} | awk '{ print $2 }'
|
||
|
|
register: expected_default_context
|
||
|
|
|
||
|
|
- assert:
|
||
|
|
that:
|
||
|
|
- fact_output.ansible_facts.ansible_selinux.config_mode in ['enforcing','permissive']
|
||
|
|
- fact_output.ansible_facts.ansible_selinux.mode in ['enforcing','permissive']
|
||
|
|
- fact_output.ansible_facts.ansible_selinux.status == 'enabled'
|
||
|
|
- fact_output.ansible_facts.ansible_selinux_python_present == true
|
||
|
|
# assert that secontext is set on the file results (injected by basic.py, for better or worse)
|
||
|
|
- tempdir.secontext is match('.+:.+:.+') and tempdir.secontext in tempdir_context_output.stdout
|
||
|
|
- file_inherited_context.secontext is match('.+:.+:.+') and file_inherited_context.secontext in inherited_context_output.stdout
|
||
|
|
- file_inherited_context.secontext == tempdir.secontext # should've been inherited from the parent dir since not set explicitly
|
||
|
|
- file_explicit_context.secontext == 'system_u:system_r:user_tmp_t:s0' and file_explicit_context.secontext in explicit_context_output.stdout
|
||
|
|
- tempdir_altered.secontext == 'system_u:system_r:user_tmp_t:s0' and tempdir_altered.secontext in tempdir_altered_context_output.stdout
|
||
|
|
# the one with reset defaults should match the original tempdir context, not the altered one (ie, it was set by the original policy context, not inherited from the parent dir)
|
||
|
|
- file_default_context.secontext == expected_default_context.stdout_lines[0]
|