Merge pull request #914 from sakshiarora13/selinux

Issue#911: Change SELinux status to permissive instead of disabling

control_plane/roles/control_plane_common/tasks/pre_requisite.yml

@@ -86,17 +86,14 @@
       register: sestatus_current
       changed_when: false
 
-    - name: Disable SElinux
-      replace:
-        path: "{{ selinux_config_path }}"
-        regexp: 'SELINUX=[a-z]+'
-        replace: 'SELINUX=disabled'
-      when: '"SELinux status:                 enabled" in sestatus_current.stdout_lines'
+    - name: Check SELinux status
+      debug:
+        msg: "{{ selinux_warning }}"
+      when: '"SELinux status:                 disabled" in sestatus_current.stdout_lines'
 
-    - name: Status of SElinux
-      fail:
-        msg: "{{ selinux_status }}"
+    - name: Set SElinux to permissive mode
+      command: setenforce 0
       when: '"SELinux status:                 enabled" in sestatus_current.stdout_lines'
-      register: selinux_value
+
   tags: init
-  when: os_supported_leap not in mgmt_os
+  when: os_supported_leap not in mgmt_os

control_plane/roles/control_plane_common/vars/main.yml

@@ -61,13 +61,12 @@ os_supported_rocky_version: "8.4"
 fail_os_status: "Unsupported OS or OS version. OS should be {{ os_supported_centos }} {{ os_supported_centos_version }} or {{ os_supported_rocky }} {{ os_supported_rocky_version }} or {{ os_supported_leap }} {{ os_supported_leap_version }}"
 success_os_status: "Management Station OS validated"
 internet_status: "Failed. No Internet connection. Make sure network is up."
-selinux_status: "SElinux is not disabled. Disable it in /etc/sysconfig/selinux and reboot the system"
+selinux_warning: "Warning! SELinux status is disabled by user. No SELinux policy is loaded"
 ansible_python_version_status: "For {{ mgmt_os }} {{ ansible_distribution_version }}, python bindings of firewalld, dnf, selinux are not available if python is installed from source and not from dnf or zypper. So please make sure python3.6 is installed using dnf or zypper. And ansible uses the python version 3.6 installed using dnf or zypper"
 python_version_support: '3.6.8'
 default_ansible_config_file_path: /etc/ansible/ansible.cfg
 invalid_run_tag_msg: "Failed. init tag should be used with run tags"
 invalid_skip_tag_msg: "Failed. init tag can't be used with skip tags"
-selinux_config_path: /etc/sysconfig/selinux
 
 # Usage: verify_login_inputs.yml
 login_vars_filename: "input_params/login_vars.yml"

control_plane/roles/control_plane_k8s/tasks/k8s_installation.yml

@@ -19,10 +19,6 @@
     fstype: swap
     state: absent
 
-- name: Disable selinux
-  selinux:
-    state: disabled
-
 - name: Copy k8s.conf file
   copy:
     src: k8s.conf

telemetry/roles/common/tasks/pre-requisites.yml

@@ -29,6 +29,27 @@
       fail:
         msg: "{{ control_plane_installation_required }}"
 
+- name: Saving management station os
+  set_fact:
+    mgmt_os: "{{ ansible_facts['distribution'] | lower }}"
+
+- block:
+    - name: Fetch SElinux mode
+      command: sestatus
+      register: sestatus_current
+      changed_when: false
+
+    - name: Check SELinux status
+      debug:
+        msg: "{{ selinux_warning }}"
+      when: '"SELinux status:                 disabled" in sestatus_current.stdout_lines'
+
+    - name: Set SElinux to permissive mode
+      command: setenforce 0
+      when: '"SELinux status:                 enabled" in sestatus_current.stdout_lines'
+
+  when: os_supported_leap not in mgmt_os
+
 - name: Check that the base_vars.yml exists
   stat:
     path: "{{ base_vars_file }}"

telemetry/roles/common/vars/main.yml

@@ -16,6 +16,9 @@
 # Usage: pre-requisites.yml
 control_plane_installation_required: "AWX and grafana installation through control_plane.yml is mandatory for telemetry.yml"
 
+os_supported_leap: "leap"
+selinux_warning: "Warning! SELinux status is disabled by user. No SELinux policy is loaded"
+
 base_vars_file: "{{ role_path }}/../../input_params/base_vars.yml"
 login_vars_file: "{{ role_path }}/../../input_params/login_vars.yml"
 ctrl_plane_login_vars_filename: "{{ role_path }}/../../../control_plane/input_params/login_vars.yml"

telemetry/telemetry.yml

@@ -16,7 +16,7 @@
 - name: Telemetry and visualization
   hosts: localhost
   connection: local
-  gather_facts: false
+  gather_facts: true
   roles:
   - common
   - timescaledb
@@ -49,4 +49,4 @@
   gather_facts: false
   roles:
    - slurm_telemetry
-  tags: slurm_telemetry
+  tags: slurm_telemetry