Check if SELinux is installed on system (#24437)

* Refactor code
* PEP8 fixes
* Check if /etc/selinux/config file exists before
  proceeding any other operations

Fixes #21622

Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>

lib/ansible/modules/system/selinux.py

@@ -71,76 +71,77 @@ EXAMPLES = '''
 
 import os
 import re
-import sys
 
 try:
     import selinux
     HAS_SELINUX = True
 except ImportError:
     HAS_SELINUX = False
+from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.facts import get_file_lines
+
 
 # getter subroutines
 def get_config_state(configfile):
-    myfile = open(configfile, "r")
+    lines = get_file_lines(configfile)
-    lines = myfile.readlines()
+
-    myfile.close()
     for line in lines:
-        stateline = re.match('^SELINUX=.*$', line)
+        stateline = re.match(r'^SELINUX=.*$', line)
-        if (stateline):
+        if stateline:
-            return(line.split('=')[1].strip())
+            return line.split('=')[1].strip()
+
 
 def get_config_policy(configfile):
-    myfile = open(configfile, "r")
+    lines = get_file_lines(configfile)
-    lines = myfile.readlines()
+
-    myfile.close()
     for line in lines:
-        stateline = re.match('^SELINUXTYPE=.*$', line)
+        stateline = re.match(r'^SELINUXTYPE=.*$', line)
-        if (stateline):
+        if stateline:
-            return(line.split('=')[1].strip())
+            return line.split('=')[1].strip()
+
 
 # setter subroutines
 def set_config_state(state, configfile):
-    #SELINUX=permissive
+    # SELINUX=permissive
     # edit config file with state value
-    stateline='SELINUX=%s' % state
+    stateline = 'SELINUX=%s' % state
-    myfile = open(configfile, "r")
-    lines = myfile.readlines()
-    myfile.close()
-    myfile = open(configfile, "w")
-    for line in lines:
-        myfile.write(re.sub(r'^SELINUX=.*', stateline, line))
-    myfile.close()
 
-def set_state(state):
+    lines = get_file_lines(configfile)
-    if (state == 'enforcing'):
+
+    with open(configfile, "w") as write_file:
+        for line in lines:
+            write_file.write(re.sub(r'^SELINUX=.*', stateline, line))
+
+
+def set_state(module, state):
+    if state == 'enforcing':
         selinux.security_setenforce(1)
-    elif (state == 'permissive'):
+    elif state == 'permissive':
         selinux.security_setenforce(0)
-    elif (state == 'disabled'):
+    elif state == 'disabled':
         pass
     else:
         msg = 'trying to set invalid runtime state %s' % state
         module.fail_json(msg=msg)
 
+
 def set_config_policy(policy, configfile):
     # edit config file with state value
-    #SELINUXTYPE=targeted
+    # SELINUXTYPE=targeted
-    policyline='SELINUXTYPE=%s' % policy
+    policyline = 'SELINUXTYPE=%s' % policy
-    myfile = open(configfile, "r")
+    lines = get_file_lines(configfile)
-    lines = myfile.readlines()
+
-    myfile.close()
+    with open(configfile, "w") as write_file:
-    myfile = open(configfile, "w")
+        for line in lines:
-    for line in lines:
+            write_file.write(re.sub(r'^SELINUXTYPE=.*', policyline, line))
-        myfile.write(re.sub(r'^SELINUXTYPE=.*', policyline, line))
+
-    myfile.close()
 
 def main():
-
     module = AnsibleModule(
-        argument_spec = dict(
+        argument_spec=dict(
             policy=dict(required=False),
             state=dict(choices=['enforcing', 'permissive', 'disabled'], required=True),
-            configfile=dict(aliases=['conf','file'], default='/etc/selinux/config')
+            configfile=dict(aliases=['conf', 'file'], default='/etc/selinux/config')
         ),
         supports_check_mode=True
     )
@@ -149,25 +150,32 @@ def main():
         module.fail_json(msg='libselinux-python required for this module')
 
     # global vars
-    changed=False
+    changed = False
-    msgs                  = []
+    msgs = []
-    configfile            = module.params['configfile']
+    configfile = module.params['configfile']
-    policy                = module.params['policy']
+    policy = module.params['policy']
-    state                 = module.params['state']
+    state = module.params['state']
-    runtime_enabled       = selinux.is_selinux_enabled()
+    runtime_enabled = selinux.is_selinux_enabled()
-    runtime_policy        = selinux.selinux_getpolicytype()[1]
+    runtime_policy = selinux.selinux_getpolicytype()[1]
-    runtime_state         = 'disabled'
+    runtime_state = 'disabled'
-    if (runtime_enabled):
+
+    if runtime_enabled:
         # enabled means 'enforcing' or 'permissive'
-        if (selinux.security_getenforce()):
+        if selinux.security_getenforce():
             runtime_state = 'enforcing'
         else:
             runtime_state = 'permissive'
-    config_policy         = get_config_policy(configfile)
+
-    config_state          = get_config_state(configfile)
+    if not os.path.isfile(configfile):
+        module.fail_json(msg="Unable to find file {0}".format(configfile),
+                         details="Please install SELinux-policy package, "
+                                 "if this package is not installed previously.")
+
+    config_policy = get_config_policy(configfile)
+    config_state = get_config_state(configfile)
 
     # check to see if policy is set if state is not 'disabled'
-    if (state != 'disabled'):
+    if state != 'disabled':
         if not policy:
             module.fail_json(msg='policy is required if state is not \'disabled\'')
     else:
@@ -175,53 +183,48 @@ def main():
             policy = config_policy
 
     # check changed values and run changes
-    if (policy != runtime_policy):
+    if policy != runtime_policy:
         if module.check_mode:
             module.exit_json(changed=True)
         # cannot change runtime policy
         msgs.append('reboot to change the loaded policy')
-        changed=True
+        changed = True
 
-    if (policy != config_policy):
+    if policy != config_policy:
         if module.check_mode:
             module.exit_json(changed=True)
         msgs.append('config policy changed from \'%s\' to \'%s\'' % (config_policy, policy))
         set_config_policy(policy, configfile)
-        changed=True
+        changed = True
 
-    if (state != runtime_state):
+    if state != runtime_state:
         if module.check_mode:
             module.exit_json(changed=True)
-        if (runtime_enabled):
+        if runtime_enabled:
-            if (state == 'disabled'):
+            if state == 'disabled':
-                if (runtime_state != 'permissive'):
+                if runtime_state != 'permissive':
                     # Temporarily set state to permissive
-                    set_state('permissive')
+                    set_state(module, 'permissive')
                     msgs.append('runtime state temporarily changed from \'%s\' to \'permissive\', state change will take effect next reboot' % (runtime_state))
                 else:
                     msgs.append('state change will take effect next reboot')
             else:
-                set_state(state)
+                set_state(module, state)
                 msgs.append('runtime state changed from \'%s\' to \'%s\'' % (runtime_state, state))
         else:
             msgs.append('state change will take effect next reboot')
-        changed=True
+        changed = True
 
-    if (state != config_state):
+    if state != config_state:
         if module.check_mode:
             module.exit_json(changed=True)
         msgs.append('config state changed from \'%s\' to \'%s\'' % (config_state, state))
         set_config_state(state, configfile)
-        changed=True
+        changed = True
 
-    module.exit_json(changed=changed, msg=', '.join(msgs),
+    module.exit_json(changed=changed, msg=', '.join(msgs), configfile=configfile, policy=policy, state=state)
-        configfile=configfile,
-        policy=policy, state=state)
 
 #################################################
-# import module snippets
-from ansible.module_utils.basic import *
 
 if __name__ == '__main__':
     main()
-

test/sanity/pep8/legacy-files.txt

@@ -539,7 +539,6 @@ lib/ansible/modules/system/puppet.py
 lib/ansible/modules/system/runit.py
 lib/ansible/modules/system/seboolean.py
 lib/ansible/modules/system/sefcontext.py
-lib/ansible/modules/system/selinux.py
 lib/ansible/modules/system/seport.py
 lib/ansible/modules/system/service.py
 lib/ansible/modules/system/solaris_zone.py