Petr Lautrbach 9d2435
---
Petr Lautrbach 9d2435
- hosts: localhost
Petr Lautrbach 9d2435
  vars:
Petr Lautrbach 9d2435
  - artifacts: "{{ lookup('env', 'TEST_ARTIFACTS')|default('./artifacts', true) }}"
Petr Lautrbach 9d2435
  tags:
Petr Lautrbach 9d2435
  - classic
Petr Lautrbach 9d2435
  tasks:
Petr Lautrbach 9d2435
  # switch SELinux to permissive mode
Petr Lautrbach 9d2435
  - name: Get default kernel
Petr Lautrbach 9d2435
    command: "grubby --default-kernel"
Petr Lautrbach 9d2435
    register: default_kernel
Petr Lautrbach 9d2435
  - debug: msg="{{ default_kernel.stdout }}"
Petr Lautrbach 9d2435
  - name: Set permissive mode
Petr Lautrbach 9d2435
    command: "grubby --args=enforcing=0 --update-kernel {{ default_kernel.stdout }}"
Petr Lautrbach 9d2435
Petr Lautrbach 9d2435
  - name: reboot
Petr Lautrbach 9d2435
    block:
Petr Lautrbach 9d2435
      - name: restart host
Petr Lautrbach 9d2435
        shell: sleep 2 && shutdown -r now "Ansible updates triggered"
Petr Lautrbach 9d2435
        async: 1
Petr Lautrbach 9d2435
        poll: 0
Petr Lautrbach 9d2435
        ignore_errors: true
Petr Lautrbach 9d2435
Petr Lautrbach 9d2435
      - name: wait for host to come back
Petr Lautrbach 9d2435
        wait_for_connection:
Petr Lautrbach 9d2435
          delay: 10
Petr Lautrbach 9d2435
          timeout: 300
Petr Lautrbach 9d2435
Petr Lautrbach 9d2435
      - name: Re-create /tmp/artifacts
Petr Lautrbach 9d2435
        command: mkdir /tmp/artifacts
Petr Lautrbach 9d2435
Petr Lautrbach 9d2435
      - name: Gather SELinux denials since boot
Petr Lautrbach 9d2435
        shell: |
Petr Lautrbach 16c37d
            result=pass
Petr Lautrbach 16c37d
            dmesg | grep -i -e type=1300 -e type=1400 > /tmp/avc.log && result=fail
Petr Lautrbach 16c37d
            ausearch -m avc -m selinux_err -m user_avc -ts boot &>> /tmp/avc.log
Petr Lautrbach 16c37d
            grep -q '<no matches>' /tmp/avc.log || result=fail
Petr Lautrbach 16c37d
            echo -e "\nresults:\n- test: reboot and collect AVC\n  result: $result\n  logs:\n  - avc.log\n\n" > /tmp/results.yml
Petr Lautrbach 16c37d
            ( [ $result = "pass" ] && echo PASS test-reboot || echo FAIL test-reboot ) > /tmp/test.log
Petr Lautrbach 9d2435
Petr Lautrbach 9d2435
    always:
Petr Lautrbach 9d2435
      - name: Pull out the artifacts
Petr Lautrbach 9d2435
        fetch:
Petr Lautrbach 9d2435
          dest: "{{ artifacts }}/"
Petr Lautrbach 9d2435
          src: "{{ item }}"
Petr Lautrbach 9d2435
          flat: yes
Petr Lautrbach 9d2435
        with_items:
Petr Lautrbach 16c37d
          - /tmp/test.log
Petr Lautrbach 9d2435
          - /tmp/avc.log
Petr Lautrbach 9d2435
          - /tmp/results.yml