Issue 1:
Issue Type:

Bug Report

Ansible Version:

ansible 1.5.4

Environment:

RHEL 5/6

Summary:

When copying files to NFS, they fail with the following error:

failed: [myhost] => {"cur_context": ["system_u", "object_r", "nfs_t", "s0"], "failed": true, "gid": 0, "group": "root", "input_was": ["system_u", "object_r", "usr_t", "s0"], "md5sum": "mymd5sum", "mode": "0644", "new_context": ["system_u", "object_r", "usr_t", "s0"], "owner": "root", "path": "/my/nfs/mount", "secontext": "system_u:object_r:nfs_t:s0", "size": 1234, "state": "file", "uid": 0}

msg: invalid selinux context

Steps To Reproduce:

Use copy module to copy a file to an nfs mount.

Expected Results:

The file is copied to the nfs mount.

Actual Results:

Error message from above:

failed: [myhost] => {"cur_context": ["system_u", "object_r", "nfs_t", "s0"], "failed": true, "gid": 0, "group": "root", "input_was": ["system_u", "object_r", "usr_t", "s0"], "md5sum": "mymd5sum", "mode": "0644", "new_context": ["system_u", "object_r", "usr_t", "s0"], "owner": "root", "path": "/my/nfs/mount", "secontext": "system_u:object_r:nfs_t:s0", "size": 1234, "state": "file", "uid": 0}

msg: invalid selinux context

I just ran into issue #5632 - "invalid selinux context" with template over ZFS and NFS. The "fix" there was to add better debugging output, but that wasn't really a fix because it's still failing. the core of the issue seems to be that one cannot change context on NFS mounts (for the most part). Ansible should check for contexts of “nfs_t”, and not bother trying to change context if that's the case. I worked around this by forcing the context of the entire mount to the context ansible was trying to set, but that's not a great workaround because if ansible decides to set different contexts based on the files I'm copying over, one or the other will fail. Note I have selinux set to permissive, so the problem is not with selinux (per se).

There are a few potential fixes:

have some way of allowing users to control the selinux context in the playbook/copy module. this would then let me override ansible and force the "nfs_t" context when copying to nfs. Not great as a user experience because I have to track when/if I'm copying to nfs, but better than nothing. Worth noting this use case in the docs if this is indeed the appropriate fix as it wouldn't be obvious from the error message.

detecting if a file is destined for a nfs mount, and if so, skip the attempt to change selinux context. this seems to be the approach that puppet took, from my googling: http://projects.puppetlabs.com/issues/1681

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

handlers listen

ANSIBLE VERSION

2.2

CONFIGURATION

N/A

OS / ENVIRONMENT

N/A

SUMMARY

While writing test for handlers listen, I found inconsistencies in how handlers are marked for execution:

If handlers listen, it is not necessarily a must that they require a name (as we notify the listen param), if the task notifies two or more handlers having the same module (here set_fact) only one handler will be executed:

handlers:
- set_fact:
notify_listen_ran_1: True
listen: notify_listen

- set_fact:
notify_listen_ran_2: True
listen: notify_listen

Because ansible uses the "module/plugin" name (https://github.com/ansible/ansible/blob/devel/lib/ansible/playbook/task.py#L120 and https://github.com/ansible/ansible/blob/devel/lib/ansible/executor/task_queue_manager.py#L150), only the first handler will be executed.

STEPS TO REPRODUCE

- name: test handlers listen
hosts: localhost
gather_facts: false
connection: local
pre_tasks:
- name: notify some handlers
command: echo foo
notify:
- notify_listen
tasks:
- meta: flush_handlers

- name: assert all defined handlers ran without error
assert:
that:
- "notify_listen_ran_1 is defined"
- "notify_listen_ran_2 is defined"

handlers:
- set_fact:
notify_listen_ran_1: True
listen: notify_listen

- set_fact:
notify_listen_ran_2: True
listen: notify_listen

EXPECTED RESULTS

My suggestion is, that we enforce to have a handler name specified. So Ansible should fail for handlers without a name.

ACTUAL RESULTS

No config file found; using defaults
[WARNING]: Host file not found: /etc/ansible/hosts

[WARNING]: provided hosts list is empty, only localhost is available

PLAYBOOK: test_handlers_listen2.yml ********************************************
1 plays in test_handlers_listen2.yml

PLAY [test handlers listen] ****************************************************

TASK [notify some handlers] ****************************************************
task path: /home/resmo/Projects/resmo/ansible/test/integration/test_handlers_listen2.yml:6
NOTIFIED HANDLER set_fact
changed: [localhost] => {"changed": true, "cmd": ["echo", "foo"], "delta": "0:00:00.002432", "end": "2016-10-01 08:47:41.952511", "rc": 0, "start": "2016-10-01 08:47:41.950079", "stderr": "", "stdout": "foo", "stdout_lines": ["foo"], "warnings": []}

RUNNING HANDLER [set_fact] *****************************************************
ok: [localhost] => {"ansible_facts": {"notify_listen_ran_1": true}, "changed": false}

TASK [assert all defined handlers ran without error] ***************************
task path: /home/resmo/Projects/resmo/ansible/test/integration/test_handlers_listen2.yml:13
fatal: [localhost]: FAILED! => {
"assertion": "notify_listen_ran_2 is defined",
"changed": false,
"evaluated_to": false,
"failed": true
}
to retry, use: --limit @/home/resmo/Projects/resmo/ansible/test/integration/test_handlers_listen2.retry

PLAY RECAP *********************************************************************
localhost : ok=2 changed=1 unreachable=0 failed=1