10fc6d9035
The log directory for nova has the default_t SELinux context and this prevents rsyslog from accessing nova's logs. This patch ensures that the file contexts are set properly for nova's logs. This change also makes nova's log directory configurable using the `nova_log_dir` variable. Closes-Bug: 1748911 Change-Id: Iaac69c5807715f50386624602375c89adeeb48a1
82 lines
2.9 KiB
YAML
82 lines
2.9 KiB
YAML
---
|
|
# Copyright 2017, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# TODO(mhayden): Remove this task during the Rocky development cycle.
|
|
- name: Check for SELinux equivalence for /var/lib/nova
|
|
shell: "semanage fcontext -l /var/lib/nova | grep '^/var/lib/nova = /var/log/libvirt$' || true"
|
|
register: fcontext_check
|
|
tags:
|
|
- skip_ansible_lint
|
|
|
|
# NOTE(mhayden): The old equivalence added in Pike is removed here since it
|
|
# is superseded by the task right after this one.
|
|
# TODO(mhayden): Remove this task during the Rocky development cycle.
|
|
- name: Remove SELinux fcontext equivalence for nova instance directory
|
|
command: semanage fcontext --delete --equal /var/log/libvirt /var/lib/nova
|
|
failed_when: selinux_equivalence.rc not in [0,1]
|
|
changed_when: selinux_equivalence.rc == 0
|
|
register: selinux_equivalence
|
|
when:
|
|
- '"/var/lib/nova" not in fcontext_check.stdout'
|
|
|
|
- name: Set SELinux file contexts for nova's ssh keys
|
|
sefcontext:
|
|
target: "/var/lib/nova/\\.ssh(/.*)?"
|
|
setype: "ssh_home_t"
|
|
state: present
|
|
register: selinux_file_context_ssh_keys
|
|
|
|
- name: Apply updated SELinux contexts on /var/lib/nova
|
|
command: restorecon -R /var/lib/nova
|
|
when:
|
|
- selinux_equivalence | changed or selinux_file_context_ssh_keys | changed
|
|
|
|
- name: Stat nova's log directory
|
|
stat:
|
|
path: "{{ nova_log_dir }}"
|
|
register: nova_log_dir_check
|
|
|
|
- name: Set SELinux file contexts for nova's log directory
|
|
sefcontext:
|
|
target: "{{ (nova_log_dir_check.stat.islnk) | ternary(nova_log_dir_check.stat.lnk_target, nova_log_dir) }}(/.*)?"
|
|
setype: nova_log_t
|
|
state: present
|
|
register: selinux_file_context_log_files
|
|
|
|
- name: Apply updated SELinux contexts on nova log directory
|
|
command: "restorecon -Rv {{ (nova_log_dir_check.stat.islnk) | ternary(nova_log_dir_check.stat.lnk_target, nova_log_dir) }}"
|
|
when:
|
|
- selinux_file_context_log_files | changed
|
|
|
|
- name: Copy OSA SELinux policy
|
|
copy:
|
|
src: osa-nova.te
|
|
dest: /tmp/osa-nova.te
|
|
|
|
# NOTE(mhayden): Linting checks are skipped here because there isn't a
|
|
# reliable way to determine if this SELinux module is newer than the one that
|
|
# is currently in use on the system. The linter expects there to be a
|
|
# "creates" argument below.
|
|
- name: Compile new SELinux policy
|
|
command: "{{ item }}"
|
|
args:
|
|
chdir: "/tmp/"
|
|
with_items:
|
|
- checkmodule -M -m -o osa-nova.mod osa-nova.te
|
|
- semodule_package -o osa-nova.pp -m osa-nova.mod
|
|
- semodule -i osa-nova.pp
|
|
tags:
|
|
- skip_ansible_lint
|