# Ansible: SELinux and multiple handlers

**URL:** <https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247>\
**Category:** Rocky Linux Help & Support\
**Created:** [June 9, 2023, 4:18pm UTC](https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247 "2023-06-09T16:18:26Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [June 9, 2023, 4:18pm UTC](https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247/1 "2023-06-09T16:18:26Z")

</div>

Hi,

I’m currently facing a problem that seems simple but it’s not. Here goes.

I rent a series of servers at [Scaleway.com](http://Scaleway.com). In the default configuration SELinux is deactivated. So the first thing I do after installing Rocky Linux 8 is enable SELinux in `enforcing` mode:

```auto
- name: Enable SELinux
  ansible.posix.selinux:
    policy: targeted
    state: enforcing

```

This action would require no less than two actions:

1. Create an empty `/.autorelabel` file (so the whole filesystem gets relabeled after the next reboot).
2. Reboot.

Now how would I translate this in Ansible syntax? Here’s what I imagine:

```auto
notify: Relabel
notify: Reboot

```

But as far as I know, multiple handlers are not possible. And I’d also have to make sure that the `Relabel` handler is actually executed before the `Reboot` handler, which is not sure.

Any suggestions ?

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [June 9, 2023, 4:41pm UTC](https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247/2 "2023-06-09T16:41:19Z")

</div>

I’ll answer this myself, since I just found a solution. Here goes:

```auto
- name: Enable SELinux
  ansible.posix.selinux:
    policy: targeted
    state: enforcing
  notify: Relabel

```

And here’s the content of handlers/main.yml :

```auto
- name: Relabel
  ansible.builtin.file:
    path: /.autorelabel
    state: touch
  notify: Reboot

- name: Reboot
  ansible.builtin.reboot:

```

Tested, and it works. But I’m still open for suggestions if you have a better idea.

---

<div class="post-metadata">

**Author:** ![jlehtone](https://avatars.discourse-cdn.com/v4/letter/j/e9a140/32.png) [@jlehtone](https://forums.rockylinux.org/u/jlehtone)\
**Post date:** [June 9, 2023, 4:46pm UTC](https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247/3 "2023-06-09T16:46:59Z")

</div>

Multiple should be possible. See [ansible - Order of notify handlers - Stack Overflow](https://stackoverflow.com/questions/35130051/order-of-notify-handlers)

IIRC, I did try (and fail) two notify lines myself too.

* * *

Alternative is to register on the selinux task and conditionally touch the file, if selinux task did change system.

Handlers are nice when multiple tasks may require action X, but you need to do X only once, _after_ all those tasks. I presume that you don’t need to touch /.autorelabel for any other reason than that one task?

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [June 9, 2023, 4:49pm UTC](https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247/4 "2023-06-09T16:49:36Z")

</div>

> [@](#):
>
> I presume that you don’t need to touch /.autorelabel for any other reason than that one task?

Yes. So a `notify` cascade makes sense here. Even though it’s a bit awkward.

---

<div class="post-metadata">

**Author:** ![microlinux](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/microlinux/32/1244_2.png) [@microlinux](https://forums.rockylinux.org/u/microlinux)\
**Post date:** [June 9, 2023, 6:59pm UTC](https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247/5 "2023-06-09T18:59:20Z")

</div>

By the way, here’s my first collection of roles and playbooks:

> **[Nicolas Kovacs / Ansible · GitLab](https://gitlab.com/kikinovak/ansible)**
>
> GitLab.com

---

<div class="post-metadata">

**Author:** ![brian](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/brian/32/5777_2.png) [@brian](https://forums.rockylinux.org/u/brian)\
**Post date:** [August 25, 2023, 3:11am UTC](https://forums.rockylinux.org/t/ansible-selinux-and-multiple-handlers/10247/6 "2023-08-25T03:11:03Z")

</div>