Implement SELinux workaround tasks

roles/ping_exporter/molecule/default/verify.yml

@@ -4,6 +4,10 @@
   gather_facts: false
   any_errors_fatal: true
 
+  #
+  # NOTE: SELinux workarounds are not tested due to container limitations
+  #
+
   tasks:
     - name: "Include default vars"
       ansible.builtin.include_vars:

roles/ping_exporter/tasks/main.yml

@@ -51,9 +51,10 @@
     group: root
     mode: "0644"
 
-# a workaround for an issue reported here: https://github.com/czerwonk/ping_exporter/issues/152
+- name: "Apply SELinux workarounds"
-- name: "Change `ping_t` SELinux domain to persmissive"
+  when:
-  when: ansible_os_family == "RedHat"
+    - ansible_facts.os_family == "RedHat"
-  community.general.selinux_permissive:
+    - ansible_selinux.status is defined
-    name: ping_t
+    - ansible_selinux.status != "disabled"
-    permissive: true
+  ansible.builtin.include_tasks:
+    file: selinux.yml

roles/ping_exporter/tasks/selinux.yml

@@ -0,0 +1,18 @@
+# a workaround for an issue reported here: https://github.com/czerwonk/ping_exporter/issues/152
+- name: "Ensure SELinux management tools are installed"
+  ansible.builtin.package:
+    name: policycoreutils-python-utils
+    state: present
+
+- name: "Override SELinux fcontext for ping_exporter binary"
+  community.general.sefcontext:
+    target: /usr/bin/ping_exporter
+    setype: bin_t
+    state: present
+
+- name: "Apply SELinux context to ping_exporter binary"
+  register: ping_exporter_restorecon
+  changed_when: ping_exporter_restorecon.stdout | length > 0
+  notify: "Restart-ping-exporter"
+  ansible.builtin.command:
+    cmd: restorecon -v /usr/bin/ping_exporter