Display SELinux errors

https://pulp.plan.io/issues/9007
closes #9007

CHANGES/9007.misc

@@ -0,0 +1 @@
+Display SELinux errors even on permissive mode

roles/pulp_devel/tasks/install_basic_packages.yml

@@ -15,6 +15,7 @@
       - gnupg
       - rubygems
       - npm
+      - rsyslog
     state: present
   retries: "{{ pulp_devel_package_retries }}"
   register: result

roles/pulp_devel/tasks/main.yml

@@ -69,4 +69,32 @@
     src: motd
     dest: /etc/motd
   become: true
+
+- name: Check SELinux logs
+  stat:
+    path: "/var/log/audit/audit.log"
+  register: selinuxlog
+
+- name: SELinux Analyze
+  shell: |
+    set -o pipefail
+    sealert --analyze=/var/log/audit/audit.log | grep "SELinux is preventing"
+  args:
+    # Debian defaults to bourne, but it doesn't understand pipefail.
+    executable: /bin/bash
+  changed_when: false
+  register: selinux_analyze
+  check_mode: false
+  become: true
+  when:
+    - selinuxlog.stat.exists
+    - ansible_facts.os_family == "RedHat"
+
+- name: SELinux status
+  debug:
+    var: selinux_analyze.stdout_lines
+  when:
+    - ansible_facts.os_family == "RedHat"
+    - selinuxlog.stat.exists
+    - selinux_analyze.stdout
 ...

roles/pulp_devel/templates/alias.bashrc.j2

@@ -149,6 +149,11 @@ pyclean () {
 }
 _pyclean_help="Cleanup extra python files"
 
+pselinux () {
+        sealert --analyze=/var/log/audit/audit.log | grep "SELinux is preventing"
+}
+_pselinux_help="Display SELinux errors"
+
 pbindings(){
     CURRENT_DIR=$(pwd)
     lang="${2:-python}"

roles/pulp_devel/vars/CentOS-7.yml

@@ -4,3 +4,4 @@ pulp_devel_distro_pkgs:
   - python-virtualenvwrapper
   - ruby-devel
   - jnettop
+  - setroubleshoot

roles/pulp_devel/vars/CentOS-8.yml

@@ -8,3 +8,4 @@ pulp_devel_distro_pkgs:
   - python3-virtualenv-clone
   - vim-enhanced
   - ruby-devel
+  - setroubleshoot

roles/pulp_devel/vars/Fedora-34.yml

@@ -12,3 +12,4 @@ pulp_devel_distro_pkgs:
   - vim-enhanced
   - ruby-devel
   - crun
+  - setroubleshoot

roles/pulp_devel/vars/Fedora.yml

@@ -12,3 +12,4 @@ pulp_devel_distro_pkgs:
   - vim-enhanced
   - ruby-devel
   - jnettop
+  - setroubleshoot

vagrant/playbooks/pre_tasks/selinux-workarounds.yml

@@ -15,6 +15,15 @@
     - ansible_facts.os_family == 'RedHat'
     - ansible_facts.distribution_major_version | int != 7
 
+- name: Install loggers
+  yum:
+    name:
+      - rsyslog
+      - setroubleshoot
+  become: true
+  when:
+    - ansible_facts.os_family == 'RedHat'
+
 # e.g. `ausearch -m AVC,USER_AVC` to see all SELinux errors,
 # rather than having Pulp fail on the 1st SELinux error.
 - name: Set SELinux to permissive to facilitate debugging