mirror of
https://github.com/ansible/ansible.git
synced 2026-08-01 00:34:56 +02:00
1d16ef3334
When the seuser parameter is provided but SELinux is not enabled on the target system, the parameter is silently ignored and the module reports changed: true. This misleads users into thinking SELinux user mappings were applied. Emit a warning when seuser is set and SELinux is not enabled, so users are aware the parameter has no effect. This uses module.selinux_enabled() to check at runtime rather than checking the platform type, as recommended by the maintainers. The warning alone is not enough — useradd still receives the -Z flag and fails with "useradd: -Z requires SELinux enabled kernel". Skip adding -Z to the command when SELinux is not enabled. Fixes #85542 --------- Co-authored-by: olegnazarov23 <olegnazarov23@users.noreply.github.com>
25 lines
850 B
YAML
25 lines
850 B
YAML
- name: test seuser parameter emits warning when SELinux is not enabled
|
|
when: not ansible_facts.selinux.status is defined or ansible_facts.selinux.status != 'enabled'
|
|
block:
|
|
- name: create user with seuser on non-SELinux system
|
|
user:
|
|
name: ansibulluser_seuser
|
|
state: present
|
|
seuser: user_u
|
|
register: user_seuser_result
|
|
|
|
- name: validate warning is emitted for seuser on non-SELinux system
|
|
assert:
|
|
that:
|
|
- user_seuser_result.warnings is defined
|
|
- user_seuser_result.warnings | length > 0
|
|
- "'seuser' in user_seuser_result.warnings[0]"
|
|
- "'SELinux' in user_seuser_result.warnings[0]"
|
|
- "'ignored' in user_seuser_result.warnings[0]"
|
|
|
|
always:
|
|
- name: remove test user
|
|
user:
|
|
name: ansibulluser_seuser
|
|
state: absent
|