diff options
| author | Scott Dodson <sdodson@redhat.com> | 2016-07-18 11:08:01 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2016-07-18 11:08:01 -0400 |
| commit | ac4ef6bb65c24890592b6b35b11be82f4ddc6deb (patch) | |
| tree | d66219432856fbbe06e45f48be765336432e0819 | |
| parent | 8b02aad331c03a172a02d7405c03069d18ff51e7 (diff) | |
| parent | ce976181d94be39c5510252c1faef4e796bc48c3 (diff) | |
| download | openshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.tar.gz openshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.tar.bz2 openshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.tar.xz openshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.zip | |
Merge pull request #2166 from abutcher/check-sebool
Check for existence of sebooleans prior to setting.
| -rw-r--r-- | roles/openshift_node/tasks/storage_plugins/glusterfs.yml | 30 | ||||
| -rw-r--r-- | roles/openshift_node/tasks/storage_plugins/nfs.yml | 16 |
2 files changed, 38 insertions, 8 deletions
diff --git a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml index 8fc8497fa..4fd9cd10b 100644 --- a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml +++ b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml @@ -3,14 +3,30 @@ action: "{{ ansible_pkg_mgr }} name=glusterfs-fuse state=present" when: not openshift.common.is_atomic | bool -- name: Set sebooleans to allow gluster storage plugin access from containers +- name: Check for existence of virt_use_fusefs seboolean + command: getsebool virt_use_fusefs + register: virt_use_fusefs_output + when: ansible_selinux and ansible_selinux.status == "enabled" + failed_when: false + changed_when: false + +- name: Set seboolean to allow gluster storage plugin access from containers seboolean: - name: "{{ item }}" + name: virt_use_fusefs state: yes persistent: yes + when: ansible_selinux and ansible_selinux.status == "enabled" and virt_use_fusefs_output.rc == 0 + +- name: Check for existence of virt_sandbox_use_fusefs seboolean + command: getsebool virt_sandbox_use_fusefs + register: virt_sandbox_use_fusefs_output when: ansible_selinux and ansible_selinux.status == "enabled" - with_items: - - virt_use_fusefs - - virt_sandbox_use_fusefs - register: sebool_result - failed_when: "'state' not in sebool_result and 'msg' in sebool_result and 'SELinux boolean {{ item }} does not exist' not in sebool_result.msg" + failed_when: false + changed_when: false + +- name: Set seboolean to allow gluster storage plugin access from containers(sandbox) + seboolean: + name: virt_sandbox_use_fusefs + state: yes + persistent: yes + when: ansible_selinux and ansible_selinux.status == "enabled" and virt_sandbox_use_fusefs_output.rc == 0 diff --git a/roles/openshift_node/tasks/storage_plugins/nfs.yml b/roles/openshift_node/tasks/storage_plugins/nfs.yml index 8380714d4..e384c1bd7 100644 --- a/roles/openshift_node/tasks/storage_plugins/nfs.yml +++ b/roles/openshift_node/tasks/storage_plugins/nfs.yml @@ -3,16 +3,30 @@ action: "{{ ansible_pkg_mgr }} name=nfs-utils state=present" when: not openshift.common.is_atomic | bool +- name: Check for existence of virt_use_nfs seboolean + command: getsebool virt_use_nfs + register: virt_use_nfs_output + when: ansible_selinux and ansible_selinux.status == "enabled" + failed_when: false + changed_when: false + - name: Set seboolean to allow nfs storage plugin access from containers seboolean: name: virt_use_nfs state: yes persistent: yes + when: ansible_selinux and ansible_selinux.status == "enabled" and virt_use_nfs_output.rc == 0 + +- name: Check for existence of virt_sandbox_use_nfs seboolean + command: getsebool virt_sandbox_use_nfs + register: virt_sandbox_use_nfs_output when: ansible_selinux and ansible_selinux.status == "enabled" + failed_when: false + changed_when: false - name: Set seboolean to allow nfs storage plugin access from containers(sandbox) seboolean: name: virt_sandbox_use_nfs state: yes persistent: yes - when: ansible_selinux and ansible_selinux.status == "enabled" + when: ansible_selinux and ansible_selinux.status == "enabled" and virt_sandbox_use_nfs_output.rc == 0 |