73 lines
3.2 KiB
YAML
73 lines
3.2 KiB
YAML
---
|
|
- name: 'SELinux: Add port to "zabbix_agent_port_t" type'
|
|
when: >-
|
|
agent_apply_seport is defined and agent_apply_seport
|
|
and
|
|
agent_param_listenport is defined and agent_param_listenport | int != 10050
|
|
become: true
|
|
ansible.builtin.command: >-
|
|
semanage port -a -t zabbix_agent_port_t -p tcp {{ agent_param_listenport }}
|
|
register: agent_register_semanage_state
|
|
changed_when: >-
|
|
agent_register_semanage_state.rc | int == 0 and
|
|
(agent_register_semanage_state.stdout + agent_register_semanage_state.stderr) == ""
|
|
failed_when: >-
|
|
agent_register_semanage_state.rc | int == 1 and
|
|
(agent_register_semanage_state.stdout + agent_register_semanage_state.stderr)
|
|
| regex_search("already defined") is none
|
|
tags: [selinux, deploy]
|
|
|
|
- name: SELinux module block
|
|
when: agent_apply_semodule is defined and agent_apply_semodule
|
|
become: true
|
|
notify: Service restart
|
|
vars:
|
|
agent_internal_semodule: zabbix_agent_extend
|
|
tags: [selinux, deploy]
|
|
block:
|
|
# - name: 'SELinux module : Get status'
|
|
# ansible.builtin.command: 'semodule -lfull | grep zabbix_agent_extend'
|
|
# register: semodule_status
|
|
# - name: 'Debug'
|
|
# ansible.builtin.debug:
|
|
# var: semodule_status
|
|
- name: "SELinux module : Upload"
|
|
ansible.builtin.template:
|
|
src: "{{ agent_internal_semodule }}.cil.j2"
|
|
dest: "{{ agent_semodules_path }}/{{ agent_internal_semodule }}.cil"
|
|
mode: "{{ agent_conf_file.permissions.mode }}"
|
|
owner: "{{ agent_conf_file.permissions.user }}"
|
|
group: "{{ agent_conf_file.permissions.group }}"
|
|
- name: "SELinux module : Install/Rewrite"
|
|
ansible.builtin.command: semodule -vi {{ agent_internal_semodule }}.cil
|
|
### if policy changes it needs rewriting... no idempotency for now. anyway its impossible with single command output.
|
|
changed_when: true
|
|
args:
|
|
chdir: "{{ agent_semodules_path }}"
|
|
register: zabbix_agent_semodule_result
|
|
- name: "SELinux module : Enable module"
|
|
when: (zabbix_agent_semodule_result.stdout + zabbix_agent_semodule_result.stderr) | regex_search("disabled", igonrecase=True) is not none
|
|
ansible.builtin.command: semodule -e {{ agent_internal_semodule }}
|
|
changed_when: true
|
|
- name: "SELinux module: Restore file context"
|
|
when: >-
|
|
agent_variant | string == "2"
|
|
ansible.builtin.command: restorecon -v /usr/sbin/zabbix_agent2
|
|
register: agent_internal_restorecon_result
|
|
changed_when: (agent_internal_restorecon_result.stderr + agent_internal_restorecon_result.stdout) | regex_search("relabeled", ignorecase=True) is not none
|
|
|
|
### modify seboolean if set, skip if not set.
|
|
- name: "Seboolean: zabbix_run_sudo"
|
|
when:
|
|
- agent_seboolean_zabbix_run_sudo is defined and agent_seboolean_zabbix_run_sudo in ["on", "off"]
|
|
become: true
|
|
ansible.posix.seboolean:
|
|
name: zabbix_run_sudo
|
|
ignore_selinux_state: false
|
|
persistent: true
|
|
state: "{{ agent_internal_zabbix_run_sudo_state }}"
|
|
vars:
|
|
agent_internal_sebool_state_map: { "on": true, "off": false }
|
|
agent_internal_zabbix_run_sudo_state: "{{ agent_internal_sebool_state_map[agent_seboolean_zabbix_run_sudo] }}"
|
|
tags: [selinux, deploy]
|