I have an Ansible playbook where one task adds a SELinux file context and the following tasks is supposed to use that new context - i.e. fix the file context of a directory if necessary.
When I run the playbook it looks like the second task still uses the old file context policy. That means it doesn't fix the directory's context as expected. Only after I run the playback a second time the context is fixed.
Example output from first run:
TASK [web : add file contexts] ****
# Addition to semanage file context mappings
+/srv/fubar(/.*)? a system_u:object_r:httpd_sys_content_t:s0
changed: [example.org]
TASK [create webroot] **********
--- before
+++ after
@@ -1,7 +1,7 @@
{
"path": "/srv/fubar",
"secontext": [
- "unconfined_u",
+ "system_u",
"object_r",
"var_t",
"s0"
changed: [example.org]
Whereas the immediate playbook re-execution yields:
TASK [web : add file contexts] ****
ok: [example.org]
TASK [create webroot] *******
--- before
+++ after
@@ -3,7 +3,7 @@
"secontext": [
"system_u",
"object_r",
- "var_t",
+ "httpd_sys_content_t",
"s0"
]
}
changed: [example.org]
Further executions don't yield any changes, as expected.
The Ansible tasks look like this:
- name: add file contexts
sefcontext:
target: '/srv/fubar(/.*)?'
setype: httpd_sys_content_t
state: present
- name: create webroot
file:
state: directory
dest: /srv/fubar
owner: juser
group: juser
mode: '0755'
setype: _default
seuser: _default
What am I missing here?
Is there some race-condition when updating the SELinux file contexts like that, in general?
When looking it the log files, there is some SELinux message saying that the policy was reloaded - right before the next task is executed, though. This matches also the sefcontext
module documentation which states that SELinux policy reload is enabled, by default.