SELINUX_Works is of type <type 'str'> and we were unable to convert to bool

[mlaurent205]

AWS
Ubuntu 18.04.6 LTS (GNU/Linux 4.15.0-189-generic x86_64) and
Ubuntu 18.04.6 LTS (GNU/Linux 5.4.0-1135-aws x86_64)

ansible-freeipa/roles/ipaclient/library/ipaclient_test.py

Line 502 in 16a4eb8

selinux_works = False

TASK [freeipa.ansible_freeipa.ipaclient : Install - Create IPA NSS database] *******************************************
Tuesday 12 November 2024 09:44:27 -0600 (0:00:00.034) 0:00:26.251 ******
fatal: [aws-freeipa-ubuntu-staging-1804.wpnops.cloud]: FAILED! => {"changed": false, "msg": "argument 'selinux_works' is of type <type 'str'> and we were unable to convert to bool: The value '' is not a valid boolean. Valid booleans include: 0, 'on', 'f', 'false', 1, 'no', 'n', '1', '0', 't', 'y', 'off', 'yes', 'true'"}

[rjeffman]

The error seems to be on your playbook, as this message is generated by Ansible when it evaluates arguments.

selinux_works is defined as a bool, and used as a bool in the code.

Do you have selinux_works: '' (or with anything that evals to an empty string) on your playbook?

[mlaurent205]

I do not have such variables defined, it is not within the variables that can be used in the role. El lun, 2 dic 2024 a la(s) 7:27 p.m., Rafael Guterres Jeffman ( ***@***.***) escribió:

…

The error seems to be on your playbook, as this message is generated by Ansible when it evaluates arguments. selinux_works is defined as a bool, and used as a bool in the code. Do you have selinux_works: '' (or with anything that evals to an empty string) on your playbook? — Reply to this email directly, view it on GitHub <#1313 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AMGE5L4LR2I4CTLMFYCH5B32DUCG7AVCNFSM6AAAAABRUO32HGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMJTGMZTQOJWGI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- *Ing. Manuel Laurent Obando* Administrador de Infraestructura de TI Cel. 6168-1292

[rjeffman]

Both on ansible-freeipa and on FreeIPA the only values this variable receives is True or False, as the variable holds a boolean value.

We need more info to have any clue on what is going on.

[mlaurent205]

Ok, so I'm going to run the role execution with that variable as false. Since my provisioning disables it. El mar, 3 dic 2024 a la(s) 11:48 a.m., Rafael Guterres Jeffman ( ***@***.***) escribió:

…

Both on ansible-freeipa and on FreeIPA the only values this variable receives is True or False, as the variable holds a boolean value. We need more info to have any clue on what is going on. — Reply to this email directly, view it on GitHub <#1313 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AMGE5L4FSWEH352PWFSZMH32DXVHNAVCNFSM6AAAAABRUO32HGVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKMJVGIZDAOBZGU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- *Ing. Manuel Laurent Obando* Administrador de Infraestructura de TI Cel. 6168-1292

[t-woerner]

The ipaclient_test module is using tasks.check_selinux_status() imported from ipaplatform.
It seems that check_selinux_status is not implemented for debian.

https://github.com/freeipa/ansible-freeipa/blob/master/roles/ipaclient/library/ipaclient_test.py#L538

There should be an additional try and except to catch this case.

[rjeffman]

It's interesting that it seems to work fine on Ubundu 20.04, 24.04, and Debian 11.

[t-woerner]

Is there a patch for ipaplatform/debian added?

[rjeffman]

Not from my side. I haven't looked at the Ubuntu/Debian packages.

[t-woerner]

This is an issue for older IPA releases if selinux is not enabled as check_selinux_status does not return a bool value.

ipaplatform/redhat/tasks.py:

    def check_selinux_status(self, restorecon=paths.RESTORECON):
        if not selinux_enabled():
            return
        if not os.path.exists(restorecon):
            raise RuntimeError('SELinux is enabled but %s does not exist.\n'
                               'Install the policycoreutils package and start '
                               'the installation again.' % restorecon)

ipaplatform/debian/tasks.py

class DebianTaskNamespace(RedHatTaskNamespace):

[rjeffman]

The issue happens on any FreeIPA version before 4.8.0.