community.general.serestorecon module – Restore SELinux file contexts

Note

This module is part of the community.general collection (version 14.0.0).

You might already have this collection installed if you are using the ansible package. It is not included in ansible-core. To check whether it is installed, run ansible-galaxy collection list.

To install it, use: ansible-galaxy collection install community.general. You need further requirements to be able to use this module, see Requirements for details.

To use it in a playbook, specify: community.general.serestorecon.

New in community.general 13.5.0

Synopsis

  • Restores SELinux file contexts to the values defined by the active SELinux policy.

  • Similar to the restorecon command.

Requirements

The below requirements are needed on the host that executes this module.

  • SELinux Python bindings (libselinux-python or distribution equivalent)

Parameters

Parameter

Comments

context

string

Controls which components of the SELinux context are restored.

type restores only the SELinux type component.

user_role restores the SELinux user, role, and type components while preserving the existing range.

user_role requires SELinux Python bindings that expose SELINUX_RESTORECON_SET_USER_ROLE, introduced in libselinux 3.9.

full restores the complete policy-defined SELinux context.

Choices:

  • "type" ← (default)

  • "user_role"

  • "full"

cross_filesystems

boolean

Whether recursive processing can include paths on filesystems other than the filesystem containing path.

When false, paths whose device ID differs from path are skipped.

This option only has an effect when recurse=true.

Choices:

  • false

  • true ← (default)

exclude_paths

list / elements=path

Paths to exclude when recursively processing path.

An excluded directory and all of its contents are skipped.

path itself is always processed.

Default: []

path

path / required

Path whose SELinux file context should be restored.

recurse

boolean

Whether to process files and directories recursively below path.

Choices:

  • false ← (default)

  • true

Attributes

Attribute

Support

Description

check_mode

Support: full

Can run in check_mode and return changed status prediction without modifying target.

diff_mode

Support: full

Returns details on what has changed (or possibly needs changing in check_mode), when in diff mode.

Examples

- name: Restore the SELinux type for a file
  community.general.serestorecon:
    path: /etc/httpd/conf/httpd.conf

- name: Recursively restore SELinux types
  community.general.serestorecon:
    path: /var/www/html
    recurse: true

- name: Restore contexts while excluding a directory
  community.general.serestorecon:
    path: /var/www/html
    recurse: true
    exclude_paths:
      - /var/www/html/cache

- name: Do not process paths on other filesystems
  community.general.serestorecon:
    path: /srv
    recurse: true
    cross_filesystems: false

- name: Restore the SELinux user, role, and type
  community.general.serestorecon:
    path: /var/www/html
    recurse: true
    context: user_role

- name: Restore the complete policy-defined SELinux context
  community.general.serestorecon:
    path: /var/www/html
    recurse: true
    context: full

Return Values

Common return values are documented here, the following are the fields unique to this module:

Key

Description

changed_paths

list / elements=dictionary

Paths whose SELinux contexts were restored.

Returned: success

path

string

Path whose SELinux context required restoration.

Returned: success

Sample: "/var/www/html/index.html"

previous

string

SELinux context before restoration.

Returned: success

Sample: "system_u:object_r:var_t:s0"

restored

string

SELinux context read back after restoration.

Returned: success

Sample: "system_u:object_r:httpd_sys_content_t:s0"

Authors

  • Nicholas Brodersen (@NicholasBrodersen)