Problem:
The problem we’re facing with linux system role’s selinux role might not be 100% at the right spot here, but it’s somehow related to Foreman and how Ansible is executed. Let’s cut to the chase. We’re heavily using linux system roles for configuring our AlmaLinux machines. When installing a selinux policy module, we’re facing a strange behaviour. The execution of the Ansible role through Foreman is missing the crucial parameter path. We were able to nail it down to the line
This works perfectly fine if we execute the role from the shell on the Foreman proxy. But if we trigger it through the UI, this results in an empty string. __selinux_item.path and __escaped_file do contain the path parameter we submitted.
Test wise we adjusted the task name from
- name: Get checksum for {{ __selinux_item.path }}
to
- name: Get checksum for {{ __selinux_item.path }} {{ __escaped_file }} {{ __resolved_file }} {{ lookup('fileglob', __escaped_file) }}
You see, the variables turn empty with lookup('fileglob', __escaped_file).
6251:
TASK [redhat.rhel_system_roles.selinux : Get checksum for "/tmp/certmonger.pp" "/tmp/certmonger.pp" [] []] ***
6252:
task path: /usr/share/ansible/collections/ansible_collections/redhat/rhel_system_roles/roles/selinux/tasks/selinux_load_module.yml:15
6253:
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: foreman-proxy
6254:
<localhost> EXEC /bin/sh -c 'echo ~foreman-proxy && sleep 0'
6255:
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /usr/share/foreman-proxy/.ansible/tmp `"&& mkdir "` echo /usr/share/foreman-proxy/.ansible/tmp/ansible-tmp-1760626236.7817414-3874622-250388914731643 `" && echo ansible-tmp-1760626236.7817414-3874622-250388914731643="` echo /usr/share/foreman-proxy/.ansible/tmp/ansible-tmp-1760626236.7817414-3874622-250388914731643 `" ) && sleep 0'
6256:
Using module file /usr/lib/python3.12/site-packages/ansible/modules/stat.py
6257:
<localhost> PUT /tmp/ansible-local-3873912uiu7mzfj/tmpwgiyhaoi TO /var/lib/foreman-proxy/ansible/tmp/ansible-tmp-1760626236.7817414-3874622-250388914731643/AnsiballZ_stat.py
6258:
<localhost> EXEC /bin/sh -c 'chmod u+x /usr/share/foreman-proxy/.ansible/tmp/ansible-tmp-1760626236.7817414-3874622-250388914731643/ /usr/share/foreman-proxy/.ansible/tmp/ansible-tmp-1760626236.7817414-3874622-250388914731643/AnsiballZ_stat.py && sleep 0'
6259:
<localhost> EXEC /bin/sh -c '/usr/bin/python3.12 /usr/share/foreman-proxy/.ansible/tmp/ansible-tmp-1760626236.7817414-3874622-250388914731643/AnsiballZ_stat.py && sleep 0'
6260:
<localhost> EXEC /bin/sh -c 'rm -f -r /usr/share/foreman-proxy/.ansible/tmp/ansible-tmp-1760626236.7817414-3874622-250388914731643/ > /dev/null 2>&1 && sleep 0'
6261:
ok: [vm-0041.service.int.rabe.ch -> localhost] => {
6262:
"changed": false,
6263:
"invocation": {
6264:
"module_args": {
6265:
"checksum_algorithm": "sha256",
6266:
"follow": false,
6267:
"get_attributes": true,
6268:
"get_checksum": true,
6269:
"get_mime": true,
6270:
"path": "[]"
6271:
}
6272:
},
6273:
"stat": {
6274:
"exists": false
6275:
}
6276:
}
I think it’s an issue with the context Foreman proxy is executing the role, but I wasn’t able to narrow it further down. Anyone had similar issues and having an explanation and solution for it?
Foreman and Proxy versions:
3.14.0
Foreman and Proxy plugin versions:
| — | — |
|---|---|
| foreman-tasks | 10.0.2 |
| foreman_ansible | 15.0.7 |
| foreman_bootdisk | 22.0.3 |
| foreman_discovery | 25.1.1 |
| foreman_openscap | 10.2.1 |
| foreman_remote_execution | 15.0.2 |
| foreman_statistics | 2.1.0 |
| foreman_templates 10.0.7 | |
| foreman_webhooks | 4.0.1 |
| katello | 4.16.2 |
Distribution and version:
AlmaLinux 9.6 (Sage Margay)
Other relevant data: