selinux.module State Fails to Report Changes

[doc987]

SELinux modules appear to successfully install (if not present) or update (if installed, but have changes). See example below.

selinux_module_name:
  selinux.module:
    - name: module_name
    - install: True
    - source: salt://module_name.pp

However, selinux.module doesn't report having changes in the result summary for the minion, and any requisites that are tied to changes don't get triggered. I imagine a typical requisite might be to run restorecon when a module changes.

selinux_module_name_restorecon:
  cmd.run:
    - name: restorecon -R ... paths specified in module fc file
    - onchanges: [selinux_module_name]

What would be really fancy is to have an option to automatically run restorecon on all file paths with contexts specified in the module fc file.

Salt Version: 2017.7.3

[garethgreenaway]

@doc987 Thanks for the report. This would be useful, marking it as a future feature request.

[doc987]

Just to clarify, the last paragraph is a feature request, but I think the rest describes a bug. selinux.module should be reporting when changes are made.

[mchugh19]

I was just looking into this as well as it would be useful to holistically manage te/pp files. However, I don't know that changes are exposed.

The selinux.module ultimately uses semodule -i modulename.pp to install the pp module, but it doesn't appear that semodule has any facility for detecting changes in module versions.

# cp localpolicy.pp.v1 localpolicy.pp
# semodule -i localpolicy.pp -v
Attempting to install module 'localpolicy.pp':
Ok: return value of 0.
Committing changes:
Ok: transaction number 0.
# cp localpolicy.pp.v2 localpolicy.pp
cp: overwrite ‘localpolicy.pp’? y
# semodule -i localpolicy.pp -v
Attempting to install module 'localpolicy.pp':
Ok: return value of 0.
Committing changes:
Ok: transaction number 0.

That output is the same if localpolicy is changed or unchanged. @doc987 do you know of any way to identify if modules include changes?

[doc987]

Does it matter that the file is for an selinux module? I was thinking that Salt would determine whether or not the pp file had changed, and only run semodule -i if the file had changed. That also avoids (if there are no changes) the significant time it takes to run semodule -i, which can result in even more time savings when multiple selinux modules are in a Salt state.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

If this issue is closed prematurely, please leave a comment and we will gladly reopen the issue.

[stale[bot]]

Thank you for updating this issue. It is no longer marked as stale.