diff --git a/roles/ping_exporter/molecule/default/verify.yml b/roles/ping_exporter/molecule/default/verify.yml index 2df0873..6d0e36c 100644 --- a/roles/ping_exporter/molecule/default/verify.yml +++ b/roles/ping_exporter/molecule/default/verify.yml @@ -4,6 +4,10 @@ gather_facts: false any_errors_fatal: true + # + # NOTE: SELinux workarounds are not tested due to container limitations + # + tasks: - name: "Include default vars" ansible.builtin.include_vars: diff --git a/roles/ping_exporter/tasks/main.yml b/roles/ping_exporter/tasks/main.yml index 623b89f..9b1d921 100644 --- a/roles/ping_exporter/tasks/main.yml +++ b/roles/ping_exporter/tasks/main.yml @@ -50,3 +50,11 @@ owner: ping_exporter group: root mode: "0644" + +- name: "Apply SELinux workarounds" + when: + - ansible_facts.os_family == "RedHat" + - ansible_selinux.status is defined + - ansible_selinux.status != "disabled" + ansible.builtin.include_tasks: + file: selinux.yml diff --git a/roles/ping_exporter/tasks/selinux.yml b/roles/ping_exporter/tasks/selinux.yml new file mode 100644 index 0000000..8496106 --- /dev/null +++ b/roles/ping_exporter/tasks/selinux.yml @@ -0,0 +1,18 @@ +# a workaround for an issue reported here: https://github.com/czerwonk/ping_exporter/issues/152 +- name: "Ensure SELinux management tools are installed" + ansible.builtin.package: + name: policycoreutils-python-utils + state: present + +- name: "Override SELinux fcontext for ping_exporter binary" + community.general.sefcontext: + target: /usr/bin/ping_exporter + setype: bin_t + state: present + +- name: "Apply SELinux context to ping_exporter binary" + register: ping_exporter_restorecon + changed_when: ping_exporter_restorecon.stdout | length > 0 + notify: "Restart-ping-exporter" + ansible.builtin.command: + cmd: restorecon -v /usr/bin/ping_exporter