SELinux state is changed from "enforcing" to "permissive" when nginx_config_selinux: true about ansible-role-nginx-config HOT 2 CLOSED

I was trying to understand the logic of setup-selinux.yml:

• I don't understand why the task that changes state to permissive is needed even when nginx_config_selinux_enforcing is true (temporarily set state to permissive to prevent any potential failures while SELinux is being configured?).

• It looks like the second condition of the task that sets SELinux state to enforcing may not be met because ansible facts (which were gathered at the beginning of the playbook run) returnsenforcing despite the actual SELinux mode of the target being permissive at the time the task is evaluating the conditional

from ansible-role-nginx-config.

• I don't understand why the task that changes state to permissive is needed even when nginx_config_selinux_enforcing is true (temporarily set state to permissive to prevent any potential failures while SELinux is being configured?).

Yep pretty much.

• It looks like the second condition of the task that sets SELinux state to enforcing may not be met because ansible facts (which were gathered at the beginning of the playbook run) returnsenforcing despite the actual SELinux mode of the target being permissive at the time the task is evaluating the conditional

You are right, I missed that gather facts only runs at launch. I'll have a fix in place shortly.

from ansible-role-nginx-config.