PR#211: blockerbugs: set another sebool so openid works - fedora-infra/ansible

fedora-infra / ansible

#211 blockerbugs: set another sebool so openid works

Merged 3 years ago by tflink. Opened 3 years ago by tflink.

Unknown source fix-blockerbugs-openid into master

blockerbugs: set another sebool so openid works

Tim Flink • 3 years ago

442fd1b

file modified

		`@@ -41,6 +41,12 @@`
		`- httpd`
		`- blockerbugs`

		`+ - name: allow httpd to connect to network, enabling openid`
		`+ seboolean: name=httpd_can_network_connect state=true persistent=true`
		`+ tags:`
		`+ - config`
		`+ - blockerbugs`
		`+`
		`- name: set sebooleans so blockerbugs can talk to the db`
		`seboolean: name=httpd_can_network_connect_db state=true persistent=true`
		`tags:`

tflink commented 3 years ago

Turns out that the httpd_can_network_connect sebool has to be set in
newer OSs (previous was el7) in order for python_openid to be able to
initiate discovery as part of login.

This is a simple change that sets httpd_can_network_connect to 1 for the
blockerbugs role that should only affect machines running the app.