Repository: ansible/ansible

Issue:
seboolean module needs to handle new selinux library change


##### ISSUE TYPE
 - Bug Report


##### COMPONENT NAME
seboolean module

##### ANSIBLE VERSION
```
$ ansible --version
ansible 2.3.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.13 (default, May 10 2017, 20:04:28) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]
$ rpm -q ansible
ansible-2.3.0.0-3.fc25.noarch
```

##### CONFIGURATION
calling ansible-playbook with `-e 'ansible_python_interpreter=/usr/bin/python3'`


##### OS / ENVIRONMENT
Fedora 25  - target is F26 Atomic Host

##### SUMMARY
Underlying libselinux python library changed from returning bytes to strings for call to `selinux.security_get_boolean_names()`. See this [BZ](https://bugzilla.redhat.com/show_bug.cgi?id=1460818) and this [upstream PR](https://github.com/SELinuxProject/selinux/commit/b8711e2eaf4f83bf943ac8ad28c35cb1db9c001f) for details. The code [here](https://github.com/ansible/ansible/blob/025b52938eb449b48e6ac57254161ad4673ab79c/lib/ansible/modules/system/seboolean.py#L76-L85) needs to be updated to handle either case I guess. 

##### STEPS TO REPRODUCE
Boot an f26 machine and:
```
+[dustymabe@media f26atomic (master *%=)]$ ansible all -b -i 192.168.121.125, -u vagrant -k -m seboolean -a "name=virt_use_nfs persistent=yes state=yes" -e 'ansible_python_interpreter=/usr/bin/python3'
SSH password: 
192.168.121.125 | FAILED! => {
    "changed": false, 
    "failed": true, 
    "msg": "SELinux boolean virt_use_nfs does not exist."
}
```
It fails. Running with python2 is just fine:
```
:[dustymabe@media f26atomic (master *%=)]$ ansible all -b -i 192.168.121.125, -u vagrant -k -m seboolean -a "name=virt_use_nfs persistent=yes state=yes"
SSH password: 
192.168.121.125 | SUCCESS => {
    "changed": true, 
    "name": "virt_use_nfs"
}
```

versions of libselinux-python on the target machine:
```
+[dustymabe@media f26atomic (master *%=)]$ ansible all -b -i 192.168.121.125, -u vagrant -k -a "rpm -q libselinux-python libselinux-python3" 
SSH password: 
 [WARNING]: Consider using yum, dnf or zypper module rather than running rpm

192.168.121.125 | SUCCESS | rc=0 >>
libselinux-python-2.6-6.fc26.x86_64
libselinux-python3-2.6-6.fc26.x86_64

```



Discussion:
@mscherer any ideas?
Awesome, so now, we have to manage bytes/strings issue on different selinux version :/ 

I am gonna do some test, I have a Fedora 26 beta ready here (non atomic however), shouldn't be too hard to find a workaround.

Resolving patch:
diff --git a/lib/ansible/modules/system/seboolean.py b/lib/ansible/modules/system/seboolean.py
--- a/lib/ansible/modules/system/seboolean.py
+++ b/lib/ansible/modules/system/seboolean.py
@@ -79,7 +79,12 @@ def has_boolean_value(module, name):
         rc, bools = selinux.security_get_boolean_names()
     except OSError:
         module.fail_json(msg="Failed to get list of boolean names")
-    if to_bytes(name) in bools:
+    # work around for selinux who changed its API, see
+    # https://github.com/ansible/ansible/issues/25651
+    if len(bools) > 0:
+        if isinstance(bools[0], binary_type):
+            name = to_bytes(name)
+    if name in bools:
         return True
     else:
         return False
@@ -224,6 +229,7 @@ def main():
 # import module snippets
 from ansible.module_utils.basic import *
 from ansible.module_utils._text import to_bytes
+from ansible.module_utils.six import binary_type
 
 if __name__ == '__main__':
     main()


Test patch: