From 04ebcba1a095fd8be36c7a49d4adeab7d9602ac3 Mon Sep 17 00:00:00 2001 From: Tod Detre Date: Fri, 4 Sep 2026 13:58:21 -0400 Subject: [PATCH] fix: relabel Splunk install dir after unarchive, only when SELinux is enabled unarchive extracts files with the extracting process's default SELinux context, which on an enforcing host can mismatch the context splunkd's own policy expects for $SPLUNK_HOME -- restorecon corrects that. Gated on ansible_facts.selinux.status so this is a no-op (rather than a hard failure) on any host without an SELinux userland -- restorecon doesn't exist there, e.g. Debian/Ubuntu -- and changed_when: false since relabeling doesn't represent state this playbook should ever report as "changed". --- roles/splunk_common/tasks/install_splunk_tgz.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/roles/splunk_common/tasks/install_splunk_tgz.yml b/roles/splunk_common/tasks/install_splunk_tgz.yml index 609d655d..a343e653 100644 --- a/roles/splunk_common/tasks/install_splunk_tgz.yml +++ b/roles/splunk_common/tasks/install_splunk_tgz.yml @@ -63,3 +63,10 @@ delay: "{{ retry_delay }}" become: yes become_user: "{{ privileged_user }}" + +- name: Apply SELinux file context to Splunk install dir + ansible.builtin.command: "restorecon -irv {{ splunk.home }}" + when: ansible_facts.selinux.status | default('disabled') == 'enabled' + changed_when: false + become: yes + become_user: "{{ privileged_user }}"