Skip to content

Instantly share code, notes, and snippets.

@Pablohn26
Last active January 3, 2016 08:09
Show Gist options
  • Save Pablohn26/8434558 to your computer and use it in GitHub Desktop.
Save Pablohn26/8434558 to your computer and use it in GitHub Desktop.
Selinux problem: invalid selinux context
Hi,
I am having problems when I use the template module over a ZFS filesystem with NFS mounted with a selinux context for Apache.
The command is the next:
- name: Base Files - template /cluster/default/apache/created/index.html.j2
template: src=cluster/default/apache/created/index.html.j2 dest=/cluster/default/apache/created/index.html owner=apache group=apache mode=0644
I have also used:
- name: Base Files - template /cluster/default/apache/created/index.html.j2
template: src=cluster/default/apache/created/index.html.j2 dest=/cluster/default/apache/created/index.html owner=apache group=apache mode=0644 selevel="s0" serole="object_r" seuser="system_u" setype="httpd_sys_content_t"
The context and content of the folder is the next:
[root@cp-dev02 apache]# ls -laZ created/
drwxr-xr-x. 80 80 system_u:object_r:httpd_sys_content_t:s0 .
drwxr-xr-x. 80 80 system_u:object_r:httpd_sys_content_t:s0 ..
-rw-------. root 80 system_u:object_r:httpd_sys_content_t:s0 .index.html.15770.1389707624.44
-rw-------. root 80 system_u:object_r:httpd_sys_content_t:s0 .index.html.16057.1389711860.52
(... more hidden files of each try...)
cat /etc/fstab:
10.199.3.26:/mnt/tank/cluster/default /cluster/default nfs defaults,nolock,noatime,nodiratime,actimeo=3,context=system_u:object_r:httpd_sys_content_t:s0 0 0
TASK: [control | Base Files - template /cluster/default/apache/created/index.html.j2] ***
<10.199.3.26> ESTABLISH CONNECTION FOR USER: root
<10.199.3.26> EXEC ['ssh', '-tt', '-vvv', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/pablo/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', 'PasswordAuthentication=no', '-o', 'User=root', '-o', 'ConnectTimeout=10', '10.199.3.26', "/bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1389782629.68-141511421134203 && echo $HOME/.ansible/tmp/ansible-tmp-1389782629.68-141511421134203'"]
<10.199.3.26> EXEC ['ssh', '-tt', '-vvv', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/pablo/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', 'PasswordAuthentication=no', '-o', 'User=root', '-o', 'ConnectTimeout=10', '10.199.3.26', u'/bin/sh -c \'rc=0; [ -r "/cluster/default/apache/created/index.html" ] || rc=2; [ -f "/cluster/default/apache/created/index.html" ] || rc=1; [ -d "/cluster/default/apache/created/index.html" ] && rc=3; (/usr/bin/md5sum /cluster/default/apache/created/index.html 2>/dev/null) || (/sbin/md5sum -q /cluster/default/apache/created/index.html 2>/dev/null) || (/usr/bin/digest -a md5 /cluster/default/apache/created/index.html 2>/dev/null) || (/sbin/md5 -q /cluster/default/apache/created/index.html 2>/dev/null) || (/usr/bin/md5 -n /cluster/default/apache/created/index.html 2>/dev/null) || (/bin/md5 -q /cluster/default/apache/created/index.html 2>/dev/null) || (/usr/bin/csum -h MD5 /cluster/default/apache/created/index.html 2>/dev/null) || (echo "${rc} /cluster/default/apache/created/index.html")\'']
<10.199.3.26> PUT /tmp/tmpDrpzWD TO /root/.ansible/tmp/ansible-tmp-1389782629.68-141511421134203/source
<10.199.3.26> PUT /tmp/tmpG6Gy6a TO /root/.ansible/tmp/ansible-tmp-1389782629.68-141511421134203/copy
<10.199.3.26> EXEC ['ssh', '-tt', '-vvv', '-o', 'ControlMaster=auto', '-o', 'ControlPersist=60s', '-o', 'ControlPath=/home/pablo/.ansible/cp/ansible-ssh-%h-%p-%r', '-o', 'Port=22', '-o', 'KbdInteractiveAuthentication=no', '-o', 'PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey', '-o', 'PasswordAuthentication=no', '-o', 'User=root', '-o', 'ConnectTimeout=10', '10.199.3.26', "/bin/sh -c '/usr/bin/python /root/.ansible/tmp/ansible-tmp-1389782629.68-141511421134203/copy; rm -rf /root/.ansible/tmp/ansible-tmp-1389782629.68-141511421134203/ >/dev/null 2>&1'"]
failed: [10.199.3.26] => {"cur_context": ["system_u", "object_r", "httpd_sys_content_t", "s0"], "failed": true, "gid": 80, "group": "80", "input_was": ["system_u", "object_r", "default_t", "s0"], "item": "", "mode": "0600", "new_context": ["system_u", "object_r", "default_t", "s0"], "owner": "root", "path": "/cluster/default/apache/created/.index.html.16728.1389782630.08", "secontext": "system_u:object_r:httpd_sys_content_t:s0", "size": 827, "state": "file", "uid": 0}
msg: invalid selinux context
FATAL: all hosts have already failed -- aborting
Environment:
-ansible-playbook --version: ansible-playbook 1.5
-yum info libselinux-python: installed
-running ansible from: Fedora Core 19, 3.12.6-200.fc19.x86_64
-running ansible over: CentOS 6, 2.6.32-431.3.1.el6.x86_64
-python --version: Python 2.7.5
Note: if I make a template over /tmp and the copy with cp command from /tmp to the folder that I want, it works and it conserves the context and permission.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment