diff --git a/files/lxc-attach.te b/files/lxc-attach.te deleted file mode 100644 index 8193e07b..00000000 --- a/files/lxc-attach.te +++ /dev/null @@ -1,24 +0,0 @@ -# Copyright 2017, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. -module lxc-attach 1.0; - -require { - type unconfined_service_t; - type var_lib_t; - class file entrypoint; -} - -#============= unconfined_service_t ============== -allow unconfined_service_t var_lib_t:file entrypoint; - diff --git a/tasks/lxc_post_install.yml b/tasks/lxc_post_install.yml index 3a0acafd..21e1efcc 100644 --- a/tasks/lxc_post_install.yml +++ b/tasks/lxc_post_install.yml @@ -125,7 +125,3 @@ # Ensure apparmor reindex runs before other things that may fail - meta: flush_handlers - -- include_tasks: lxc_selinux.yml - when: - - ansible_selinux.status == "enabled" diff --git a/tasks/lxc_selinux.yml b/tasks/lxc_selinux.yml deleted file mode 100644 index e0f3d602..00000000 --- a/tasks/lxc_selinux.yml +++ /dev/null @@ -1,64 +0,0 @@ ---- -# Copyright 2017, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -- name: Create directory for compiling SELinux policy - file: - path: "/tmp/lxc-attach-selinux/" - state: 'directory' - mode: '0755' - -- name: Deploy SELinux type enforcement file - copy: - src: "lxc-attach.te" - dest: "/tmp/lxc-attach-selinux/lxc-attach.te" - owner: "root" - group: "root" - mode: "0755" - -- name: Compile and load SELinux module - shell: 'make -f /usr/share/selinux/devel/Makefile && semodule -i /tmp/lxc-attach-selinux/lxc-attach.pp' - args: - creates: '/etc/selinux/targeted/active/modules/400/lxc-attach/cil' - chdir: "/tmp/lxc-attach-selinux/" - register: compile_selinux_async - async: 90 - poll: 0 - -- name: Check if /openstack/log exists - stat: - path: /openstack/log - register: openstack_log_dir - -- name: Check for SELinux equivalence for /openstack/log - shell: "semanage fcontext -l /openstack/log | grep ^/openstack/log || true" - register: fcontext_check - tags: - - skip_ansible_lint - -- name: Create SELinux fcontext equivalence for OpenStack container logs - command: semanage fcontext --add --equal /var/log /openstack/log - failed_when: selinux_equivalence.rc not in [0,1] - changed_when: selinux_equivalence.rc == 0 - register: selinux_equivalence - when: - - openstack_log_dir.stat.exists - - '"/openstack/log" not in fcontext_check.stdout' - -- name: Apply updated SELinux contexts on /openstack/log - command: restorecon -R /openstack/log - when: - - openstack_log_dir.stat.exists - - '"/openstack/log" not in fcontext_check.stdout' - - selinux_equivalence is changed diff --git a/tasks/main.yml b/tasks/main.yml index 8f570e3a..a8329391 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -87,16 +87,6 @@ - name: Flush handlers meta: flush_handlers -- name: Ensure SELinux module compile has finished - async_status: - jid: "{{ compile_selinux_async.ansible_job_id }}" - register: _compile_selinux_async - until: _compile_selinux_async.finished - retries: 30 - when: - - compile_selinux_async is defined - - not compile_selinux_async | skipped - - name: (RE)Gather facts post setup setup: gather_subset: "network,hardware,virtual" diff --git a/vars/redhat-7-host.yml b/vars/redhat-7-host.yml index c9d073a6..8d562c55 100644 --- a/vars/redhat-7-host.yml +++ b/vars/redhat-7-host.yml @@ -25,15 +25,12 @@ _lxc_hosts_distro_packages: - dnsmasq - git - libseccomp - - libselinux - - libselinux-devel - lxc - lxc-devel - lxc-libs - lxc-templates - policycoreutils-python - python2-lxc - - selinux-policy-devel - unzip - xz