Skip to content

Commit 566c230

Browse files
committed
Fix SELinux ansible variable name conflict
The ansible remediation for both selinux_not_disabled and selinux_state rules were using 'selinux_state' as the registered variable name for the output of the 'getenforce' command. This created a naming conflict with the 'selinux_state' boolean control (which comes from the rule id) variable used in the when conditions to determine if a rule should be applied. When roles are generated, the 'Check current SELinux state' task includes a when condition with 'selinux_state | bool' (coming from the rule id), but this creates a circular dependency since that same task is supposed to register 'selinux_state'. As a result, the task gets skipped, the variable never gets registered, and subsequent tasks that depend on checking the current SELinux state fail or are skipped. This fix renames the registered variable from 'selinux_state' to 'current_selinux_state' in both ansible remediation files to avoid the naming conflict. Fixes: #14344
1 parent 3e27ad8 commit 566c230

2 files changed

Lines changed: 4 additions & 4 deletions

File tree

linux_os/guide/system/selinux/selinux_not_disabled/ansible/shared.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
- name: "{{{ rule_title }}} - Check current SELinux state"
88
ansible.builtin.command:
99
cmd: getenforce
10-
register: selinux_state
10+
register: current_selinux_state
1111
check_mode: false
1212
changed_when: false
1313

@@ -19,4 +19,4 @@
1919
state: touch
2020
access_time: preserve
2121
modification_time: preserve
22-
when: selinux_state.stdout | lower != "permissive"
22+
when: current_selinux_state.stdout | lower != "permissive"

linux_os/guide/system/selinux/selinux_state/ansible/shared.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
- name: "{{{ rule_title }}} - Check current SELinux state"
99
ansible.builtin.command:
1010
cmd: getenforce
11-
register: selinux_state
11+
register: current_selinux_state
1212
check_mode: false
1313
changed_when: false
1414

@@ -20,4 +20,4 @@
2020
state: touch
2121
access_time: preserve
2222
modification_time: preserve
23-
when: selinux_state.stdout | lower != var_selinux_state
23+
when: current_selinux_state.stdout | lower != var_selinux_state

0 commit comments

Comments
 (0)