# Ansible can't create SELinux module

**URL:** <https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531>\
**Category:** Rocky Linux Help & Support\
**Created:** [May 23, 2025, 6:07am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531 "2025-05-23T06:07:14Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [May 23, 2025, 6:07am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/1 "2025-05-23T06:07:14Z")

</div>

Hi,

I’m currently trying to create a SELinux module using Ansible.

Here’s the command I’m using interactively in the shell:

```auto
# cd /var/tmp
# ausearch -c 'dnsmasq' --raw | audit2allow -M my_dnsmasq
# ls -l my_dnsmasq.*
-rw-r--r--. 1 root root 945 May 23 07:57 my_dnsmasq.pp
-rw-r--r--. 1 root root 179 May 23 07:57 my_dnsmasq.te

```

Here’s how I translated this in Ansible (I’ll worry about idempotency later):

```auto
- name: Generate SELinux module for Dnsmasq
  ansible.builtin.shell: |
    ausearch -c 'dnsmasq' --raw | audit2allow -M my_dnsmasq
  args:
    chdir: /var/tmp/
    executable: /bin/bash

```

Curiously enough, when I run this task it looks like something has changed and I get no error message. On the other hand, there’s no resulting `my_dnsmasq*` file anywhere on the system.

Any idea what’s going on here?

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [May 23, 2025, 6:59am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/2 "2025-05-23T06:59:11Z")

</div>

OK now here’s something very weird. It looks like Ansible’s shell module can’t handle commands like `ausearch` or `audit2allow`.

I just tested this:

```auto
- name: Test ausearch
  ansible.builtin.shell:
    cmd: /usr/sbin/ausearch -c dnsmasq --raw
    chdir: /var/tmp/
    executable: /bin/bash

```

And here’s what I get:

```auto
fatal: [localhost]: FAILED! => {"changed": true, "cmd": "/usr/sbin/ausearch -c dnsmasq --raw", "delta": "0:
00:00.023751", "end": "2025-05-23 08:53:20.364510", "msg": "non-zero return code", "rc": 1, "start": "2025-
05-23 08:53:20.340759", "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}

```

I’m beginning to understand why folks choose to disable SELinux.

---

<div class="post-metadata">

**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\
**Post date:** [May 23, 2025, 7:27am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/3 "2025-05-23T07:27:34Z")

</div>

That’s because ansible assumes that a return value of 0 would be a success, and perhaps in this case 1 is success (the rc value), so you can do:

```auto
      register: ausearch
      failed_when:
        - ausearch.rc != 1

```

the `ausearch` can be any text you like, as long as it’s followed by the `.rc` or even set:

```auto
      changed_when: ausearch.rc == 1

```

instead of failed\_when. You may need a combo of both.

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [May 23, 2025, 7:31am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/4 "2025-05-23T07:31:13Z")

</div>

Is the `*.te` (ASCII) file system-specific, or would the same rule/policy apply to all systems?  
If it is not system-specific, then you don’t need to create it in every host.

Long ago, I did use crude (for cups – I have no issues with dnsmasq):

```yaml
  - name: Remove SELinux policy package
    command: semodule -r my-cupspkhelper
    failed_when: false

  - name: Copy SELinux type enforcement file
    copy:
      src: my-cupspkhelper.te
      dest: /tmp/

  - name: Compile SELinux module file
    command: checkmodule -M -m -o /tmp/my-cupspkhelper.mod /tmp/my-cupspkhelper.te

  - name: Build SELinux policy package
    command: semodule_package -o /tmp/my-cupspkhelper.pp -m /tmp/my-cupspkhelper.mod

  - name: Load SELinux policy package
    command: semodule -i /tmp/my-cupspkhelper.pp

  - name: Remove temporary files
    file:
      path: /tmp/my-cupspkhelper.*
      state: absent

```

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [May 23, 2025, 4:29pm UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/5 "2025-05-23T16:29:25Z")

</div>

> [@iwalker](#):
>
> That’s because ansible assumes that a return value of 0 would be a success, and perhaps in this case 1 is success (the rc value), so you can do:
> 
> ```auto
> register: ausearch
> failed_when:
> - ausearch.rc != 1
> 
> ```
> 
> the `ausearch` can be any text you like, as long as it’s followed by the `.rc` or even set:
> 
> ```auto
> changed_when: ausearch.rc == 1
> 
> ```
> 
> instead of failed\_when. You may need a combo of both.

Now here’s the thing. The `ausearch` command **does** return 0 when invoked directly in a shell:

```auto
# ausearch -c dnsmasq --raw
type=AVC msg=audit(1747976451.939:101): avc: denied { getattr } for pid=2309 comm="dnsmasq" path="/etc/resolv.conf" dev="dm-2" ino=67884332 scontext=system_u:system_r:dnsmasq_t:s0 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=file permissive=0
...
# echo $?
0

```

But when I try to launch the same (!) command using Ansible’s `shell` module, it fails.

I’m confused.

---

<div class="post-metadata">

**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\
**Post date:** [May 23, 2025, 4:34pm UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/6 "2025-05-23T16:34:20Z")

</div>

Best way instead of comparing it to the console output when you do it manually, is to use the ansible register function, and then use that in a following task with debug to see all the information. Then use that with the changed\_when or failed\_when options. I have had to do this when using dnf commands in certain situations.

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [May 23, 2025, 6:52pm UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/7 "2025-05-23T18:52:04Z")

</div>

Yeah, I know. But it doesn’t even get to that. The command fails, plain and simple. Output or not. Just try it out and see for yourself.

---

<div class="post-metadata">

**Author:** ![iwalker](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/iwalker/32/2599_2.png) [@iwalker](https://forums.rockylinux.org/u/iwalker)\
**Post date:** [May 23, 2025, 7:11pm UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/8 "2025-05-23T19:11:07Z")

</div>

Well I don’t have your problem with dnsmasq because I don’t use it. And even if I run `ausearch -c dnsmasq --raw`, I don’t have anything to work with to replicate your problem.

---

<div class="post-metadata">

**Author:** ![0xC4aE1e5](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/0xc4ae1e5/32/4677_2.png) [@0xC4aE1e5](https://forums.rockylinux.org/u/0xC4aE1e5)\
**Post date:** [May 24, 2025, 1:04am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/9 "2025-05-24T01:04:36Z")

</div>

Does the following possibly work? Ignores error codes.

```auto
(ausearch -c 'dnsmasq' --raw | audit2allow -M my_dnsmasq) || true

```

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [May 24, 2025, 5:30am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/10 "2025-05-24T05:30:16Z")

</div>

> [@microlinux](#):
>
> `ausearch -c 'dnsmasq' --raw | audit2allow -M my_dnsmasq`

Even ignoring error codes doesn’t work. Here’s the thing:

```auto
- name: Generate SELinux module for Dnsmasq
  ansible.builtin.shell:
    cmd: /usr/sbin/ausearch -c dnsmasq --raw
    chdir: /var/tmp/
    executable: /bin/bash
  register: ausearch_output
  failed_when: false

- name: Display the output of the ausearch command
  ansible.builtin.debug:
    var: ausearch_output.stdout_lines

```

The `ausearch` command works perfectly directly in a shell and displays a few lines of output. But when run from Ansible, there’s no output.

At this point I’m giving up. I simply build the SELinux module by hand and put this stuff in Ansible’s README file.

Thanks everybody for your input.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [July 23, 2025, 5:30am UTC](https://forums.rockylinux.org/t/ansible-cant-create-selinux-module/18531/11 "2025-07-23T05:30:27Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.