Skip to main content

Ansible - copy and template to cifs shares with selinux enabled

With current ansible versions, the following modules will result in a error if the destination is on a cifs share using systems that have selinux enabled

  • ansible.builtin.copy
  • ansible.builtin.template
The error in question:
 invalid selinux context: [Errno 95] Operation not supported  
A possible workaround could be to first create the file using 'ansible.builtin.file' with 'state=touch' which would allow the file to be changed later on. Example:
 - name: ensure empty files are present  
   with:_items: "{{ files_to_copy + files_to_template }}"  
   ansible.builtin.file:  
     path: "{{ item['dest'] }}"  
     state: touch  
Depending on the structure of your playbooks, this task could go into the 'pre_tasks' section of your playbook, example for a full playbook:
 ---  
 - name: test  
   hosts: test  
   user: root  
   gather_facts: false  
   collections:  
     - ansible.posix  
     - community.general  
   vars:  
     src_dir: /var/tmp  
     dst_dir: /mnt/cifs  
     file_owner: root  
     file_group: root  
     file_mode: '0644'  
     files_to_copy:  
       - dest: "{{ dst_dir }}/file1"  
         owner: "{{ file_owner }}"  
         group: "{{ file_group }}"  
         mode: "{{ file_mode }}"  
         content: |  
           content of file1  
       - dest: "{{ dst_dir }}/file2"  
         owner: "{{ file_owner }}"  
         group: "{{ file_group }}"  
         mode: "{{ file_mode }}"  
         content: |  
           content of file2  
     files_to_template:  
       - src: "{{ src_dir }}/template1.j2"  
         dest: "{{ dst_dir }}/template1"  
         owner: "{{ file_owner }}"  
         group: "{{ file_group }}"  
         mode: "{{ file_mode }}"  
       - src: "{{ src_dir }}/template2.j2"  
         dest: "{{ dst_dir }}/template2"  
         owner: "{{ file_owner }}"  
         group: "{{ file_group }}"  
         mode: "{{ file_mode }}"  
   pre_tasks:  
     - name: ensure empty files are present  
       with:_items: "{{ files_to_copy + files_to_template }}"  
       ansible.builtin.file:  
         path: "{{ item['dest'] }}"  
         state: touch  
   tasks:  
     - name: copy files  
       with_items: "{{ files_to_copy }}"  
       ansible.builtin.copy:  
         src: "{{ item['src'] if item['src'] is defined else omit }}"  
         dest: "{{ item['dest'] }}"  
         owner: "{{ item['owner'] }}"  
         group: "{{ item['group'] }}"  
         mode: "{{ item['mode'] }}"  
         content: "{{ item['content'] if item['content'] is defined else omit }}"  
     - name: template files  
       with_items: "{{ files_to_template }}"  
       ansible.builtin.template:  
         src: "{{ item['src'] }}"  
         dest: "{{ }item['dest'] }"  
         owner: "{{ item['owner'] }}"  
         group: "{{ item['group'] }}"  
         mode: "{{ item['mode'] }}"  
 ...  

This should be a viable workaround to create files on cifs shares.

Feel free to comment and / or suggest a topic.

Comments