summaryrefslogtreecommitdiffstats
path: root/roles
diff options
context:
space:
mode:
authorScott Dodson <sdodson@redhat.com>2016-07-18 11:08:01 -0400
committerGitHub <noreply@github.com>2016-07-18 11:08:01 -0400
commitac4ef6bb65c24890592b6b35b11be82f4ddc6deb (patch)
treed66219432856fbbe06e45f48be765336432e0819 /roles
parent8b02aad331c03a172a02d7405c03069d18ff51e7 (diff)
parentce976181d94be39c5510252c1faef4e796bc48c3 (diff)
downloadopenshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.tar.gz
openshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.tar.bz2
openshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.tar.xz
openshift-ac4ef6bb65c24890592b6b35b11be82f4ddc6deb.zip
Merge pull request #2166 from abutcher/check-sebool
Check for existence of sebooleans prior to setting.
Diffstat (limited to 'roles')
-rw-r--r--roles/openshift_node/tasks/storage_plugins/glusterfs.yml30
-rw-r--r--roles/openshift_node/tasks/storage_plugins/nfs.yml16
2 files changed, 38 insertions, 8 deletions
diff --git a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
index 8fc8497fa..4fd9cd10b 100644
--- a/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
+++ b/roles/openshift_node/tasks/storage_plugins/glusterfs.yml
@@ -3,14 +3,30 @@
action: "{{ ansible_pkg_mgr }} name=glusterfs-fuse state=present"
when: not openshift.common.is_atomic | bool
-- name: Set sebooleans to allow gluster storage plugin access from containers
+- name: Check for existence of virt_use_fusefs seboolean
+ command: getsebool virt_use_fusefs
+ register: virt_use_fusefs_output
+ when: ansible_selinux and ansible_selinux.status == "enabled"
+ failed_when: false
+ changed_when: false
+
+- name: Set seboolean to allow gluster storage plugin access from containers
seboolean:
- name: "{{ item }}"
+ name: virt_use_fusefs
state: yes
persistent: yes
+ when: ansible_selinux and ansible_selinux.status == "enabled" and virt_use_fusefs_output.rc == 0
+
+- name: Check for existence of virt_sandbox_use_fusefs seboolean
+ command: getsebool virt_sandbox_use_fusefs
+ register: virt_sandbox_use_fusefs_output
when: ansible_selinux and ansible_selinux.status == "enabled"
- with_items:
- - virt_use_fusefs
- - virt_sandbox_use_fusefs
- register: sebool_result
- failed_when: "'state' not in sebool_result and 'msg' in sebool_result and 'SELinux boolean {{ item }} does not exist' not in sebool_result.msg"
+ failed_when: false
+ changed_when: false
+
+- name: Set seboolean to allow gluster storage plugin access from containers(sandbox)
+ seboolean:
+ name: virt_sandbox_use_fusefs
+ state: yes
+ persistent: yes
+ when: ansible_selinux and ansible_selinux.status == "enabled" and virt_sandbox_use_fusefs_output.rc == 0
diff --git a/roles/openshift_node/tasks/storage_plugins/nfs.yml b/roles/openshift_node/tasks/storage_plugins/nfs.yml
index 8380714d4..e384c1bd7 100644
--- a/roles/openshift_node/tasks/storage_plugins/nfs.yml
+++ b/roles/openshift_node/tasks/storage_plugins/nfs.yml
@@ -3,16 +3,30 @@
action: "{{ ansible_pkg_mgr }} name=nfs-utils state=present"
when: not openshift.common.is_atomic | bool
+- name: Check for existence of virt_use_nfs seboolean
+ command: getsebool virt_use_nfs
+ register: virt_use_nfs_output
+ when: ansible_selinux and ansible_selinux.status == "enabled"
+ failed_when: false
+ changed_when: false
+
- name: Set seboolean to allow nfs storage plugin access from containers
seboolean:
name: virt_use_nfs
state: yes
persistent: yes
+ when: ansible_selinux and ansible_selinux.status == "enabled" and virt_use_nfs_output.rc == 0
+
+- name: Check for existence of virt_sandbox_use_nfs seboolean
+ command: getsebool virt_sandbox_use_nfs
+ register: virt_sandbox_use_nfs_output
when: ansible_selinux and ansible_selinux.status == "enabled"
+ failed_when: false
+ changed_when: false
- name: Set seboolean to allow nfs storage plugin access from containers(sandbox)
seboolean:
name: virt_sandbox_use_nfs
state: yes
persistent: yes
- when: ansible_selinux and ansible_selinux.status == "enabled"
+ when: ansible_selinux and ansible_selinux.status == "enabled" and virt_sandbox_use_nfs_output.rc == 0