gitea/ansible.posix
1
0
Fork 0
mirror of https://github.com/ansible-collections/ansible.posix.git synced 2026-05-14 21:42:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor to comply with current ansible-lint and sanity guidelines

Browse Source 
Signed-off-by: Adam Miller <admiller@redhat.com>
This commit is contained in:
Adam Miller
2023-11-30 23:23:16 -06:00
parent 05ee6ebc2a
commit a85f736f6a
68 changed files with 2640 additions and 2407 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
tests/integration/targets/selinux/tasks/main.yml
View File

@@ -1,3 +1,4 @@
---
# (c) 2017, Sam Doran <sdoran@redhat.com>
# This file is part of Ansible
@@ -15,22 +16,26 @@
# You should have received a copy of the GNU General Public License
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
- debug:
- name: Debug message for when SELinux is disabled
ansible.builtin.debug:
msg: SELinux is disabled
when: ansible_selinux is defined and ansible_selinux == False
when: ansible_selinux is defined and not ansible_selinux
- debug:
- name: Debug message for when SELinux is enabled and not disabled
ansible.builtin.debug:
msg: SELinux is {{ ansible_selinux.status }}
when: ansible_selinux is defined and ansible_selinux != False
when: ansible_selinux is defined and ansible_selinux
- include_tasks: selinux.yml
- name: Include_tasks for when SELinux is enabled
ansible.builtin.include_tasks: selinux.yml
when:
- ansible_selinux is defined
- ansible_selinux != False
- ansible_selinux
- ansible_selinux.status == 'enabled'
- include_tasks: selogin.yml
- name: Include tasks for selogin when SELinux is enabled
ansible.builtin.include_tasks: selogin.yml
when:
- ansible_selinux is defined
- ansible_selinux != False
- ansible_selinux
- ansible_selinux.status == 'enabled'

230
tests/integration/targets/selinux/tasks/selinux.yml
View File

@@ -1,3 +1,4 @@
---
# (c) 2017, Sam Doran <sdoran@redhat.com>
# This file is part of Ansible
@@ -14,67 +15,67 @@
#
# You should have received a copy of the GNU General Public License
# along with Ansible. If not, see <http://www.gnu.org/licenses/>.
# First Test
# ##############################################################################
# Test changing the state, which requires a reboot
- name: TEST 1 | Make sure grubby is present
package:
ansible.builtin.package:
name: grubby
state: present
- name: TEST 1 | Get current SELinux config file contents
slurp:
ansible.builtin.slurp:
src: /etc/sysconfig/selinux
register: selinux_config_original_base64
- name: TEST 1 | Register SELinux config and SELinux status
set_fact:
ansible.builtin.set_fact:
selinux_config_original_raw: "{{ selinux_config_original_base64.content | b64decode }}"
before_test_sestatus: "{{ ansible_selinux }}"
- name: TEST 1 | Split by line and register original config
set_fact:
ansible.builtin.set_fact:
selinux_config_original: "{{ selinux_config_original_raw.split('\n') }}"
- debug:
- name: TEST 1 | Debug selinux_config_original, before_test_sestatus, and ansible_selinux
ansible.builtin.debug:
var: "{{ item }}"
verbosity: 1
with_items:
loop:
- selinux_config_original
- before_test_sestatus
- ansible_selinux
- name: TEST 1 | Setup SELinux configuration for tests
selinux:
ansible.posix.selinux:
state: enforcing
policy: targeted
- name: TEST 1 | Disable SELinux
selinux:
ansible.posix.selinux:
state: disabled
policy: targeted
register: _disable_test1
- debug:
- name: TEST 1 | Debug _disable_test1
ansible.builtin.debug:
var: _disable_test1
verbosity: 1
- name: Before gathering the fact
debug:
ansible.builtin.debug:
msg: "{{ ansible_selinux }}"
- name: TEST 1 | Re-gather facts
setup:
ansible.builtin.setup:
- name: After gathering the fact
debug:
ansible.builtin.debug:
msg: "{{ ansible_selinux }}"
- name: TEST 1 | Assert that status was changed, reboot_required is True, a warning was displayed, and SELinux is configured properly
assert:
ansible.builtin.assert:
that:
- _disable_test1 is changed
- _disable_test1.reboot_required
@@ -82,53 +83,56 @@
- ansible_selinux.config_mode == 'disabled'
- ansible_selinux.type == 'targeted'
- debug:
- name: TEST 1 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
- name: TEST 1 | Disable SELinux again
selinux:
ansible.posix.selinux:
state: disabled
policy: targeted
register: _disable_test2
- debug:
- name: Test 1 | Debug _disable_test2
ansible.builtin.debug:
var: _disable_test2
verbosity: 1
- name: TEST 1 | Assert that no change is reported, a warning was displayed, and reboot_required is True
assert:
ansible.builtin.assert:
that:
- _disable_test2 is not changed
- (_disable_test1.warnings | length ) >= 1
- _disable_test2.reboot_required
- name: TEST 1 | Get modified config file
slurp:
ansible.builtin.slurp:
src: /etc/sysconfig/selinux
register: selinux_config_after_base64
- name: TEST 1 | Register modified config
set_fact:
ansible.builtin.set_fact:
selinux_config_after_raw: "{{ selinux_config_after_base64.content | b64decode }}"
- name: TEST 1 | Split by line and register modified config
set_fact:
ansible.builtin.set_fact:
selinux_config_after: "{{ selinux_config_after_raw.split('\n') }}"
- debug:
- name: TEST 1 | Debug selinux_config_after
ansible.builtin.debug:
var: selinux_config_after
verbosity: 1
- name: TEST 1 | Ensure SELinux config file is properly formatted
assert:
ansible.builtin.assert:
that:
- selinux_config_original | length == selinux_config_after | length
- selinux_config_after[selinux_config_after.index('SELINUX=disabled')] is search("^SELINUX=\w+$")
- selinux_config_after[selinux_config_after.index('SELINUXTYPE=targeted')] is search("^SELINUXTYPE=\w+$")
- name: TEST 1 | Disable SELinux again, with kernel arguments update
selinux:
ansible.posix.selinux:
state: disabled
policy: targeted
update_kernel_param: true
@@ -136,72 +140,76 @@
- name: Check kernel command-line arguments
ansible.builtin.command: grubby --info=DEFAULT
changed_when: false
register: _grubby_test1
- name: TEST 1 | Assert that kernel cmdline contains selinux=0
assert:
ansible.builtin.assert:
that:
- "' selinux=0' in _grubby_test1.stdout"
- name: TEST 1 | Enable SELinux, without kernel arguments update
selinux:
ansible.posix.selinux:
state: disabled
policy: targeted
register: _disable_test2
- name: Check kernel command-line arguments
ansible.builtin.command: grubby --info=DEFAULT
changed_when: false
register: _grubby_test1
- name: TEST 1 | Assert that kernel cmdline still contains selinux=0
assert:
ansible.builtin.assert:
that:
- "' selinux=0' in _grubby_test1.stdout"
- name: TEST 1 | Reset SELinux configuration for next test (also kernel args)
selinux:
ansible.posix.selinux:
state: enforcing
update_kernel_param: true
policy: targeted
- name: Check kernel command-line arguments
ansible.builtin.command: grubby --info=DEFAULT
changed_when: false
register: _grubby_test2
- name: TEST 1 | Assert that kernel cmdline doesn't contain selinux=0
assert:
ansible.builtin.assert:
that:
- "' selinux=0' not in _grubby_test2.stdout"
# Second Test
# ##############################################################################
# Test changing only the policy, which does not require a reboot
- name: TEST 2 | Make sure the policy is present
package:
ansible.builtin.package:
name: selinux-policy-mls
state: present
- name: TEST 2 | Set SELinux policy
selinux:
ansible.posix.selinux:
state: enforcing
policy: mls
register: _state_test1
- debug:
- name: TEST 2 | Debug _state_test1
ansible.builtin.debug:
var: _state_test1
verbosity: 1
- name: TEST 2 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 2 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
tags: debug
- name: TEST 2 | Assert that status was changed, reboot_required is False, no warnings were displayed, and SELinux is configured properly
assert:
ansible.builtin.assert:
that:
- _state_test1 is changed
- not _state_test1.reboot_required
@@ -210,76 +218,79 @@
- ansible_selinux.type == 'mls'
- name: TEST 2 | Set SELinux policy again
selinux:
ansible.posix.selinux:
state: enforcing
policy: mls
register: _state_test2
- debug:
- name: TEST 2 | Debug _state_test2
ansible.builtin.debug:
var: _state_test2
verbosity: 1
- name: TEST 2 | Assert that no change was reported, no warnings were displayed, and reboot_required is False
assert:
ansible.builtin.assert:
that:
- _state_test2 is not changed
- _state_test2.warnings is not defined
- not _state_test2.reboot_required
- name: TEST 2 | Get modified config file
slurp:
ansible.builtin.slurp:
src: /etc/sysconfig/selinux
register: selinux_config_after_base64
- name: TEST 2 | Register modified config
set_fact:
ansible.builtin.set_fact:
selinux_config_after_raw: "{{ selinux_config_after_base64.content | b64decode }}"
- name: TEST 2 | Split by line and register modified config
set_fact:
ansible.builtin.set_fact:
selinux_config_after: "{{ selinux_config_after_raw.split('\n') }}"
- debug:
- name: TEST 2 | Debug selinux_config_after
ansible.builtin.debug:
var: selinux_config_after
verbosity: 1
- name: TEST 2 | Ensure SELinux config file is properly formatted
assert:
ansible.builtin.assert:
that:
- selinux_config_original | length == selinux_config_after | length
- selinux_config_after[selinux_config_after.index('SELINUX=enforcing')] is search("^SELINUX=\w+$")
- selinux_config_after[selinux_config_after.index('SELINUXTYPE=mls')] is search("^SELINUXTYPE=\w+$")
- name: TEST 2 | Reset SELinux configuration for next test
selinux:
ansible.posix.selinux:
state: enforcing
policy: targeted
# Third Test
# ##############################################################################
# Test changing non-existing policy
- name: TEST 3 | Set SELinux policy
selinux:
ansible.posix.selinux:
state: enforcing
policy: non-existing-selinux-policy
register: _state_test1
ignore_errors: yes
ignore_errors: true
- debug:
- name: TEST 3 | Debug _state_test1
ansible.builtin.debug:
var: _state_test1
verbosity: 1
- name: TEST 3 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST3 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
tags: debug
- name: TEST 3 | Assert that status was not changed, the task failed, the msg contains proper information and SELinux was not changed
assert:
ansible.builtin.assert:
that:
- _state_test1 is not changed
- _state_test1 is failed
@@ -287,40 +298,40 @@
- ansible_selinux.config_mode == 'enforcing'
- ansible_selinux.type == 'targeted'
# Fourth Test
# ##############################################################################
# Test if check mode returns correct changed values and
# doesn't make any changes
- name: TEST 4 | Set SELinux to enforcing
selinux:
ansible.posix.selinux:
state: enforcing
policy: targeted
register: _check_mode_test1
- debug:
- name: TEST 4 | Debug _check_mode_test1
ansible.builtin.debug:
var: _check_mode_test1
verbosity: 1
- name: TEST 4 | Set SELinux to enforcing in check mode
selinux:
ansible.posix.selinux:
state: enforcing
policy: targeted
register: _check_mode_test1
check_mode: yes
check_mode: true
- name: TEST 4 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 4| Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
tags: debug
- name: TEST 4 | Assert that check mode is idempotent
assert:
ansible.builtin.assert:
that:
- _check_mode_test1 is success
- not _check_mode_test1.reboot_required
@@ -328,22 +339,23 @@
- ansible_selinux.type == 'targeted'
- name: TEST 4 | Set SELinux to permissive in check mode
selinux:
ansible.posix.selinux:
state: permissive
policy: targeted
register: _check_mode_test2
check_mode: yes
check_mode: true
- name: TEST 4 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 4 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
tags: debug
- name: TEST 4 | Assert that check mode doesn't set state permissive and returns changed
assert:
ansible.builtin.assert:
that:
- _check_mode_test2 is changed
- not _check_mode_test2.reboot_required
@@ -351,21 +363,22 @@
- ansible_selinux.type == 'targeted'
- name: TEST 4 | Disable SELinux in check mode
selinux:
ansible.posix.selinux:
state: disabled
register: _check_mode_test3
check_mode: yes
check_mode: true
- name: TEST 4 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 4 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
tags: debug
- name: TEST 4 | Assert that check mode didn't change anything, status is changed, reboot_required is True, a warning was displayed
assert:
ansible.builtin.assert:
that:
- _check_mode_test3 is changed
- _check_mode_test3.reboot_required
@@ -374,31 +387,33 @@
- ansible_selinux.type == 'targeted'
- name: TEST 4 | Set SELinux to permissive
selinux:
ansible.posix.selinux:
state: permissive
policy: targeted
register: _check_mode_test4
- debug:
- name: TEST 4 | Debug _check_mode_test4
ansible.builtin.debug:
var: _check_mode_test4
verbosity: 1
- name: TEST 4 | Disable SELinux in check mode
selinux:
ansible.posix.selinux:
state: disabled
register: _check_mode_test4
check_mode: yes
check_mode: true
- name: TEST 4 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 4 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
tags: debug
- name: TEST 4 | Assert that check mode didn't change anything, status is changed, reboot_required is True, a warning was displayed
assert:
ansible.builtin.assert:
that:
- _check_mode_test4 is changed
- _check_mode_test4.reboot_required
@@ -407,36 +422,38 @@
- ansible_selinux.type == 'targeted'
- name: TEST 4 | Set SELinux to enforcing
selinux:
ansible.posix.selinux:
state: enforcing
policy: targeted
register: _check_mode_test5
- debug:
- name: TEST 4 | Debug _check_mode_test5
ansible.builtin.debug:
var: _check_mode_test5
verbosity: 1
- name: TEST 4 | Disable SELinux
selinux:
ansible.posix.selinux:
state: disabled
register: _check_mode_test5
- name: TEST 4 | Disable SELinux in check mode
selinux:
ansible.posix.selinux:
state: disabled
register: _check_mode_test5
check_mode: yes
check_mode: true
- name: TEST 4 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 4 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
tags: debug
- name: TEST 4 | Assert that in check mode status was not changed, reboot_required is True, a warning was displayed, and SELinux is configured properly
assert:
ansible.builtin.assert:
that:
- _check_mode_test5 is success
- _check_mode_test5.reboot_required
@@ -450,32 +467,34 @@
# sure the module re-adds the expected lines
- name: TEST 5 | Remove SELINUX key from /etc/selinux/config
lineinfile:
ansible.builtin.lineinfile:
path: /etc/selinux/config
regexp: '^SELINUX='
regexp: ^SELINUX=
state: absent
backup: yes
backup: true
register: _lineinfile_out1
- debug:
- name: TEST 5 | Debug _lineinfile_out1
ansible.builtin.debug:
var: _lineinfile_out1
verbosity: 1
- name: TEST 5 | Set SELinux to enforcing
selinux:
ansible.posix.selinux:
state: enforcing
policy: targeted
register: _set_enforcing1
- name: TEST 5 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 5 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
- name: TEST 5 | Assert that SELINUX key is populated
assert:
ansible.builtin.assert:
that:
- _set_enforcing1 is success
- _set_enforcing1 is changed
@@ -483,31 +502,33 @@
- ansible_selinux.config_mode == 'enforcing'
- name: TEST 5 | Remove SELINUXTYPE key from /etc/selinux/config
lineinfile:
ansible.builtin.lineinfile:
path: /etc/selinux/config
regexp: '^SELINUXTYPE='
regexp: ^SELINUXTYPE=
state: absent
register: _lineinfile_out2
- debug:
- name: TEST 5 | Debug _lineinfile_out2
ansible.builtin.debug:
var: _lineinfile_out2
verbosity: 1
- name: TEST 5 | Set SELinux Policy to targeted
selinux:
ansible.posix.selinux:
state: enforcing
policy: targeted
register: _set_policy2
- name: TEST 5 | Re-gather facts
setup:
ansible.builtin.setup:
- debug:
- name: TEST 5 | Debug ansible_selinux
ansible.builtin.debug:
var: ansible_selinux
verbosity: 1
- name: TEST 5 | Assert that SELINUXTYPE key is populated
assert:
ansible.builtin.assert:
that:
- _set_policy2 is success
- _set_policy2 is changed
@@ -515,7 +536,8 @@
- ansible_selinux.type == 'targeted'
- name: TEST 5 | Restore original SELinux config file /etc/selinux/config
copy:
ansible.builtin.copy:
dest: /etc/selinux/config
src: "{{ _lineinfile_out1['backup'] }}"
remote_src: yes
remote_src: true
mode: "0644"

89
tests/integration/targets/selinux/tasks/selogin.yml
View File

@@ -1,70 +1,71 @@
- name: create user for testing
user:
---
- name: Create user for testing
ansible.builtin.user:
name: seuser
- name: attempt to add mapping without 'seuser'
- name: Attempt to add mapping without 'seuser'
register: selogin_error
ignore_errors: true
community.general.system.selogin:
login: seuser
- name: verify failure
assert:
- name: Verify failure
ansible.builtin.assert:
that:
- selogin_error is failed
- name: map login to SELinux user
- selogin_error is failed
- name: Map login to SELinux user
register: selogin_new_mapping
check_mode: '{{ item }}'
check_mode: "{{ item }}"
with_items:
- true
- false
- true
- false
- true
- false
- true
- false
community.general.system.selogin:
login: seuser
seuser: staff_u
- name: new mapping- verify functionality and check_mode
assert:
- name: New mapping- verify functionality and check_mode
ansible.builtin.assert:
that:
- selogin_new_mapping.results[0] is changed
- selogin_new_mapping.results[1] is changed
- selogin_new_mapping.results[2] is not changed
- selogin_new_mapping.results[3] is not changed
- name: change SELinux user login mapping
- selogin_new_mapping.results[0] is changed
- selogin_new_mapping.results[1] is changed
- selogin_new_mapping.results[2] is not changed
- selogin_new_mapping.results[3] is not changed
- name: Change SELinux user login mapping
register: selogin_mod_mapping
check_mode: '{{ item }}'
check_mode: "{{ item }}"
with_items:
- true
- false
- true
- false
- true
- false
- true
- false
community.general.system.selogin:
login: seuser
seuser: user_u
- name: changed mapping- verify functionality and check_mode
assert:
- name: Changed mapping- verify functionality and check_mode
ansible.builtin.assert:
that:
- selogin_mod_mapping.results[0] is changed
- selogin_mod_mapping.results[1] is changed
- selogin_mod_mapping.results[2] is not changed
- selogin_mod_mapping.results[3] is not changed
- name: remove SELinux user mapping
- selogin_mod_mapping.results[0] is changed
- selogin_mod_mapping.results[1] is changed
- selogin_mod_mapping.results[2] is not changed
- selogin_mod_mapping.results[3] is not changed
- name: Remove SELinux user mapping
register: selogin_del_mapping
check_mode: '{{ item }}'
check_mode: "{{ item }}"
with_items:
- true
- false
- true
- false
- true
- false
- true
- false
community.general.system.selogin:
login: seuser
state: absent
- name: delete mapping- verify functionality and check_mode
assert:
- name: Delete mapping- verify functionality and check_mode
ansible.builtin.assert:
that:
- selogin_del_mapping.results[0] is changed
- selogin_del_mapping.results[1] is changed
- selogin_del_mapping.results[2] is not changed
- selogin_del_mapping.results[3] is not changed
- name: remove test user
user:
- selogin_del_mapping.results[0] is changed
- selogin_del_mapping.results[1] is changed
- selogin_del_mapping.results[2] is not changed
- selogin_del_mapping.results[3] is not changed
- name: Remove test user
ansible.builtin.user:
name: seuser
state: absent