Comment 2 for bug 1689900

it seems the command "setenforce 0" exit with non-zero exit code when it is
already disabled. So it probably just need need to say ansible that "if you
see the message 'setenforce: SELinux is disabled'" in stderr, that is not
failure". You may do it with "failed_when" keyword in ansible.

May be something like this.

- name: Disable selinux for redhat systems
  command: setenforce 0

  register: disable_selinux

  failed_when: (disable_selinux.rc != 0 and disable_selinux.stderr not
in "setenforce: SELinux is disabled" )

  when: ansible_os_family == 'RedHat'

BTW, You may have to test this.

On Fri, May 12, 2017 at 7:37 AM, Rudra Rugge <email address hidden>
wrote:

> ** Changed in: juniperopenstack/r4.0
> Assignee: Rudra Rugge (rudrarugge) => Yuvaraja Mariappan (ymariappan)
>
> ** Changed in: juniperopenstack/trunk
> Assignee: Rudra Rugge (rudrarugge) => Yuvaraja Mariappan (ymariappan)
>
> --
> You received this bug notification because you are a member of Contrail
> Systems engineering, which is subscribed to Juniper Openstack.
> https://bugs.launchpad.net/bugs/1689900
>
> Title:
> setenforce 0 returning with exit 1 causing ansible provisioning to
> fail
>
> Status in Juniper Openstack:
> New
> Status in Juniper Openstack r4.0 series:
> New
> Status in Juniper Openstack trunk series:
> New
>
> Bug description:
> R4.0 3073
>
> On Centos 7.1.1503, 'setenforce 0' exited with non-zero value(1) and
> ansible provisioning failed.
>
> We see this manually as well on a similar node nodeg11 below
>
> https://github.com/ansible/ansible/issues/2058 seems related ?
>
> ------------
> nodeg11.englab.juniper.net:
>
> [root@nodeg11 ~]# cat /etc/redhat-release
> CentOS Linux release 7.1.1503 (Core)
> [root@nodeg11 ~]# setenforce 0
> setenforce: SELinux is disabled
> [root@nodeg11 ~]# echo $?
> 1
> [root@nodeg11 ~]#
> [root@nodeg11 ~]# getenforce
> Disabled
> [root@nodeg11 ~]#
> --------------
> ansible logs :
>
> TASK [common : Disable selinux for redhat systems]
> *****************************
> fatal: [10.204.216.222]: FAILED! => {"changed": true, "cmd":
> ["setenforce", "0"], "delta": "0:00:00.011568", "end": "2017-05-09
> 14:48:47.557790", "failed": true, "rc": 1, "start": "2017-05-09
> 14:48:47.546222", "stderr": "setenforce: SELinux is disabled", "stdout":
> "", "stdout_lines": [], "warnings": []}
> fatal: [10.204.216.59]: FAILED! => {"changed": true, "cmd":
> ["setenforce", "0"], "delta": "0:00:00.025877", "end": "2017-05-09
> 14:48:47.559846", "failed": true, "rc": 1, "start": "2017-05-09
> 14:48:47.533969", "stderr": "setenforce: SELinux is disabled", "stdout":
> "", "stdout_lines": [], "warnings": []}
> fatal: [10.204.216.221]: FAILED! => {"changed": true, "cmd":
> ["setenforce", "0"], "delta": "0:00:00.014665", "end": "2017-05-09
> 14:48:47.570706", "failed": true, "rc": 1, "start": "2017-05-09
> 14:48:47.556041", "stderr": "setenforce: SELinux is disabled", "stdout":
> "", "stdout_lines": [], "warnings": []}
> fatal: [10.204.216.58]: FAILED! => {"changed": true, "cmd":
> ["setenforce", "0"], "delta": "0:00:00.031054", "end": "2017-05-09
> 14:48:47.575227", "failed": true, "rc": 1, "start": "2017-05-09
> 14:48:47.544173", "stderr": "setenforce: SELinux is disabled", "stdout":
> "", "stdout_lines": [], "warnings": []}
> fatal: [10.204.216.60]: FAILED! => {"changed": true, "cmd":
> ["setenforce", "0"], "delta": "0:00:00.020383", "end": "2017-05-09
> 14:48:47.577564", "failed": true, "rc": 1, "start": "2017-05-09
> 14:48:47.557181", "stderr": "setenforce: SELinux is disabled", "stdout":
> "", "stdout_lines": [], "warnings": []}
> fatal: [10.204.216.223]: FAILED! => {"changed": true, "cmd":
> ["setenforce", "0"], "delta": "0:00:00.015881", "end": "2017-05-09
> 14:42:27.889286", "failed": true, "rc": 1, "start": "2017-05-09
> 14:42:27.873405", "stderr": "setenforce: SELinux is disabled", "stdout":
> "", "stdout_lines": [], "warnings": []}
> to retry, use: --limit @/home/root/jenkins/workspace/
> nodec1-sanity/contrail-ansible/playbooks/site.retry
>
> PLAY RECAP ************************************************************
> *********
> 10.204.216.221 : ok=4 changed=1 unreachable=0
> failed=1
> 10.204.216.222 : ok=4 changed=1 unreachable=0
> failed=1
> 10.204.216.223 : ok=4 changed=1 unreachable=0
> failed=1
> 10.204.216.58 : ok=4 changed=1 unreachable=0
> failed=1
> 10.204.216.59 : ok=4 changed=1 unreachable=0
> failed=1
> 10.204.216.60 : ok=4 changed=1 unreachable=0
> failed=1
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/juniperopenstack/+bug/1689900/+subscriptions
>