module

Krikri::PluginHelpers::SelinuxConfig

SelinuxConfig - the pure validation logic of ansible.posix.selinux, split out of the plugin so the arg-spec rules are unit-testable without a host that has /etc/selinux/config. Ported from the real module's main() (ansible-collections/ansible.posix):

  1. state is REQUIRED (choices enforcing/permissive/disabled) - enforced by AnsibleModule argument-spec at module init, before anything else.
  2. The /etc/selinux/config existence failure comes next (unconditional - there is no "SELinux not compiled in, treat as no-op" special case; see plugins/selinux.cr's class docs).
  3. policy is REQUIRED whenever state is not "disabled" ("Policy is required if state is not 'disabled'"); when state IS disabled and policy is omitted, real defaults it from the config's SELINUXTYPE.
  4. A policy whose /etc/selinux/<policy>/policy path does not exist is rejected ("Policy

    does not exist in /etc/selinux/") - but only when the module is actually about to rewrite SELINUXTYPE (set_config_policy), never in check mode, which exits changed=true before reaching it.

Constants

VALID_STATES = ["enforcing", "permissive", "disabled"]

Class methods

policy_exists_error(policy : String) : String | Nil
Source
policy_required?(state : String, policy : String | Nil) : Bool
Source
state_validation_error(state : String | Nil) : String | Nil
Source