Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OS harden will not enable SELinux if SELinux is disabled #537

Open
bgbak opened this issue Apr 27, 2022 · 1 comment · May be fixed by #612
Open

OS harden will not enable SELinux if SELinux is disabled #537

bgbak opened this issue Apr 27, 2022 · 1 comment · May be fixed by #612
Labels
bug

Comments

@bgbak
Copy link

bgbak commented Apr 27, 2022 •
edited

Describe the bug
In the OS Hardening role SELinux will not be enabled if SELinux is already disabled

Expected behavior
Expect SELinux to be enabled and configured.
Actual behavior

TASK [devsec.hardening.os_hardening : Configure selinux | selinux-01] ********** 
skipping: [SELinux-Disabled]
ok: [SELinux-Enabled]

Example Playbook

---
- hosts: all
  collections:
    - devsec_hardening
  roles:
    - os_hardening

OS / Environment

Both targets running CentOS 7

Ansible Version

AWX 0.20.0 on k3s.
quay.io/ansible/awx-ee:latest as execution eniroment. No modifications

Role Version

7.14.1

Additional context
This conditional will return false if SELinux is not enabled

ansible-collection-hardening/roles/os_hardening/tasks/hardening.yml

Line 96 in 1d3ea50

- ansible_facts.selinux.status == 'enabled'

@rndmh3ro rndmh3ro added the bug label May 9, 2022
@rndmh3ro
Copy link
Member

rndmh3ro commented May 9, 2022 •
edited

We should probably change that. I think this worked before...

I do see one problem though: ansible_facts.selinux.status shows disabled, whether it is actually disabled or it isn't installed at all (e.g. on debian systems).
So we should check if it is installed and only then continue enabling it.

MahdiAbbasi95 added a commit to MahdiAbbasi95/ansible-collection-hardening that referenced this issue Dec 23, 2022
@MahdiAbbasi95
Fix bug related to issue dev-sec#537
4541546 
Signed-off-by: Mahdi Abbasi <[email protected]>
@MahdiAbbasi95 MahdiAbbasi95 linked a pull request Dec 23, 2022 that will close this issue
Open
MahdiAbbasi95 added a commit to MahdiAbbasi95/ansible-collection-hardening that referenced this issue Dec 24, 2022
@MahdiAbbasi95
Fix bug related to issue dev-sec#537
7b48cef 
Signed-off-by: Mahdi Abbasi <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix bug related to issue #537 MahdiAbbasi95/ansible-collection-hardening
2 participants
@rndmh3ro @bgbak