-
Notifications
You must be signed in to change notification settings - Fork 14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Selinux playbook #19
Selinux playbook #19
Conversation
Is the aim here to run this after a broken production playbook/upgrade? Does it also need an The full production playbook may need re-run if the playbook fails on a "start OMERO.web" step due to this issue, e.g. to configure custom redirects (pub-omero) or deploy the SSL directives. |
You don't need to copy the selinux role, it sets a variable you can test later: https://github.com/openmicroscopy/ansible-role-omero-web/blob/2.0.1/tasks/web-dependencies.yml#L24 Can you also check it doesn't break the CentOS7 vagrant molecule test, since last time I tried it this fix wasn't necessary? |
Re #19 (comment), my expectation is to get this role to work under all circumstances i.e. preventing the situation of broken upgrades. I had not realized this role already depended on |
I was under the impression |
#15 (comment) |
@manics - no, all I run is what's in that comment:
Is |
Conflicting PR. Removed from build ANSIBLE-merge#466. See the console output for more details.
--conflicts |
@manics - are you sure #19 (comment) are the three commands I run each time to fix this. |
|
Conflicting PR. Removed from build ANSIBLE-merge#498. See the console output for more details.
--conflicts |
Now superseded by #21 |
Fixes #15
Rather than forcing the command discuseed in the issue in consumer playbook, this PR adds a new playbook to be executed in the case of SELinux-hardened systems.
The logic for detecting SELinux enforcement was copied from
openmicroscopy.selinux_utils
and might be dropped with the same caveats.Proposing this as a bugfix i.e.
2.0.2
although could equally be treated as2.1.0
. Arguably could be tested as part of the upgrade of Dundee production systems where SELinux is enabled.