dkirwan/infra-ansible
1
0
Fork 0
forked from infra/ansible
Code Pull requests Activity
infra-ansible/roles/pagure/tasks/selinux.yml

112 lines
2.5 KiB
YAML
Raw Normal View History

pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
---
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Check the selinux context of the git repo directory
ansiblelint fixes-- fqcn[action-core] - command to ansible.builtin.command Replaces many references to command: with ansible.builtin.command Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2024-12-19 11:22:24 +10:00
ansible.builtin.command: matchpathcon /srv/git
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
register: distgitcontext
check_mode: no
changed_when: false
tags:
- config
- pagure
- selinux
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Show the output of distgitcontext
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.builtin.debug:
distgit/pagure: fix debug calls, msg is not for variables Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-09 16:22:10 +01:00
var: distgitcontext.stdout
distgit/pagure: add some debugging to understand why it mis-behaves Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-05 17:05:27 +01:00
tags:
- selinux
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Show if we find gitosis_var_lib_t in distgitcontext
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.builtin.debug:
distgit/pagure: fix debug calls, msg is not for variables Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-09 16:22:10 +01:00
var: distgitcontext.stdout.find('gitosis_var_lib_t')
distgit/pagure: add some debugging to understand why it mis-behaves Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-05 17:05:27 +01:00
tags:
- selinux
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Set the SELinux policy for the distgit root directory
ansiblelint fixes-- fqcn[action-core] - command to ansible.builtin.command Replaces many references to command: with ansible.builtin.command Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2024-12-19 11:22:24 +10:00
ansible.builtin.command: semanage fcontext -a -t gitosis_var_lib_t "/srv/git(/.*)?"
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
when: distgitcontext.stdout.find('gitosis_var_lib_t') == -1
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
changed_when: false
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
tags:
- config
- pagure
- selinux
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Check the selinux context of the releases directory
ansiblelint fixes-- fqcn[action-core] - command to ansible.builtin.command Replaces many references to command: with ansible.builtin.command Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2024-12-19 11:22:24 +10:00
ansible.builtin.command: matchpathcon /var/www/releases
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
register: distgitcontext
check_mode: no
changed_when: false
tags:
- config
- pagure
- selinux
# Note: On Fedora its httpd_sys_content_rw_t - Don't we love confusions?
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Set the SELinux policy for the releases directory
ansiblelint fixes-- fqcn[action-core] - command to ansible.builtin.command Replaces many references to command: with ansible.builtin.command Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2024-12-19 11:22:24 +10:00
ansible.builtin.command: semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/releases(/.*)?"
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
when: distgitcontext.stdout.find('httpd_sys_rw_content_t') == -1
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
changed_when: false
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
tags:
- config
- pagure
- selinux
pagure: make use of the new selinux/module role to install/compile selinux policies Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-10 15:55:10 +01:00
- name: Install the pagure SELinux policy
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.builtin.include_role:
pagure: make use of the new selinux/module role to install/compile selinux policies Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-10 15:55:10 +01:00
name: selinux/module
vars:
pagure: fix path to the selinux policy file Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-10 15:59:32 +01:00
policy_file: files/selinux/pagure.te
pagure: make use of the new selinux/module role to install/compile selinux policies Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-10 15:55:10 +01:00
policy_name: pagure
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
tags:
pagure: make use of the new selinux/module role to install/compile selinux policies Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-11-10 15:55:10 +01:00
- selinux
- config
- pagure
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Set sebooleans so pagure can talk to the network (db + redis)
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.posix.seboolean:
name: httpd_can_network_connect
state: true
persistent: true
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
tags:
- config
- selinux
- pagure
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Set sebooleans so apache can send emails
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.posix.seboolean:
name: httpd_can_sendmail
state: true
persistent: true
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
tags:
- config
- selinux
- pagure
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Set sebooleans so pygit2 can read the git repos
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.posix.seboolean:
name: httpd_execmem
state: true
persistent: true
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
tags:
- config
- selinux
- pagure
Fix name[casing] ansible-lint issues fix 1900 failures of the following case issue: `name[casing]: All names should start with an uppercase letter.` Signed-off-by: Ryan Lerch <rlerch@redhat.com>
2025-01-14 20:18:57 +10:00
- name: Set sebooleans so ssh can retrieve access info from apache
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.posix.seboolean:
name: nis_enabled
state: true
persistent: true
pagure: update the selinux configuration for pagure Split all the selinux tasks in a different file so it's easier to read/find. Adjust the custom policy based on our latest findings. Build and compile the policy directly on the host. Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
2020-10-01 12:35:29 +02:00
tags:
- config
- selinux
- pagure
Nagios: remove nrpe from a bunch of smaller things Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-07-01 13:25:24 +01:00
- name: Set sebooleans to deny nagios/nrpe to call sudo as it's gone
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
ansible.posix.seboolean:
name: nagios_run_sudo
Nagios: remove nrpe from a bunch of smaller things Signed-off-by: Greg Sutcliffe <fedora@emeraldreverie.org>
2026-07-01 13:25:24 +01:00
state: false
[distgit] Fixing ansible lint errors This commit is fixing ansible lint errors for distgit role. It also introduces two new addition to skip list as the structure of our ansible repository doesn't adhere to ansible standards. The errors that will be now skipped are: - role-name[path] - we have plenty of roles that have sub-roles inside them and we need to access them - var-naming[no-role-prefix] - variables for roles are not usually prefixed correctly in our repository and forcing people to change that will introduce more issues than what it solves
2025-04-30 11:57:57 +02:00
persistent: true
correct task name nagios sebool
2021-06-08 02:02:00 +02:00
tags:
- config
- selinux
- pagure
Copy permalink