| --- |
| - hosts: localhost |
| vars: |
| - artifacts: "{{ lookup('env', 'TEST_ARTIFACTS')|default('./artifacts', true) }}" |
| tags: |
| - classic |
| tasks: |
| |
| - name: Get default kernel |
| command: "grubby --default-kernel" |
| register: default_kernel |
| - debug: msg="{{ default_kernel.stdout }}" |
| - name: Set permissive mode |
| command: "grubby --args=enforcing=0 --update-kernel {{ default_kernel.stdout }}" |
| |
| - name: reboot |
| block: |
| - name: restart host |
| shell: sleep 2 && shutdown -r now "Ansible updates triggered" |
| async: 1 |
| poll: 0 |
| ignore_errors: true |
| |
| - name: wait for host to come back |
| wait_for_connection: |
| delay: 10 |
| timeout: 300 |
| |
| - name: Re-create /tmp/artifacts |
| command: mkdir /tmp/artifacts |
| |
| - name: Gather SELinux denials since boot |
| shell: | |
| result=pass |
| dmesg | grep -i -e type=1300 -e type=1400 > /tmp/avc.log && result=fail |
| ausearch -m avc -m selinux_err -m user_avc -ts boot &>> /tmp/avc.log |
| grep -q '<no matches>' /tmp/avc.log || result=fail |
| echo -e "\nresults:\n- test: reboot and collect AVC\n result: $result\n logs:\n - avc.log\n\n" > /tmp/results.yml |
| ( [ $result = "pass" ] && echo PASS test-reboot || echo FAIL test-reboot ) > /tmp/test.log |
| |
| always: |
| - name: Pull out the artifacts |
| fetch: |
| dest: "{{ artifacts }}/" |
| src: "{{ item }}" |
| flat: yes |
| with_items: |
| - /tmp/test.log |
| - /tmp/avc.log |
| - /tmp/results.yml |