Add proper permission for selinux

Signed-off-by: Sébastien Han <seb@redhat.com>

roles/ceph-mds/tasks/docker/main.yml

@@ -9,5 +9,8 @@
   when: ceph_health.rc != 0
 
 - include: pre_requisite.yml
+- include: selinux.yml
+  when: ansible_os_family == 'RedHat'
+
 - include: fetch_configs.yml
 - include: start_docker_mds.yml

roles/ceph-mds/tasks/docker/selinux.yml

@@ -0,0 +1,13 @@
+---
+- name: check if selinux is enabled
+  command: getenforce
+  register: sestatus
+  changed_when: false
+
+- name: set selinux permissions
+  shell: chcon -Rt svirt_sandbox_file_t {{ item }}
+  with_items:
+    - /etc/ceph
+    - /var/lib/ceph
+  changed_when: false
+  when: sestatus.stdout != 'Disabled'

roles/ceph-mon/tasks/docker/main.yml

@@ -9,6 +9,9 @@
   when: ceph_health.rc != 0
 
 - include: pre_requisite.yml
+- include: selinux.yml
+  when: ansible_os_family == 'RedHat'
+
 - include: fetch_configs.yml
 - include: start_docker_monitor.yml
 - include: copy_configs.yml

roles/ceph-mon/tasks/docker/selinux.yml

@@ -0,0 +1,13 @@
+---
+- name: check if selinux is enabled
+  command: getenforce
+  register: sestatus
+  changed_when: false
+
+- name: set selinux permissions
+  shell: chcon -Rt svirt_sandbox_file_t {{ item }}
+  with_items:
+    - /etc/ceph
+    - /var/lib/ceph
+  changed_when: false
+  when: sestatus.stdout != 'Disabled'

roles/ceph-osd/tasks/docker/main.yml

@@ -9,5 +9,8 @@
   when: ceph_health.rc != 0
 
 - include: pre_requisite.yml
+- include: selinux.yml
+  when: ansible_os_family == 'RedHat'
+
 - include: fetch_configs.yml
 - include: start_docker_osd.yml

roles/ceph-osd/tasks/docker/selinux.yml

@@ -0,0 +1,13 @@
+---
+- name: check if selinux is enabled
+  command: getenforce
+  register: sestatus
+  changed_when: false
+
+- name: set selinux permissions
+  shell: chcon -Rt svirt_sandbox_file_t {{ item }}
+  with_items:
+    - /etc/ceph
+    - /var/lib/ceph
+  changed_when: false
+  when: sestatus.stdout != 'Disabled'

roles/ceph-rgw/tasks/docker/main.yml

@@ -9,5 +9,8 @@
   when: ceph_health.rc != 0
 
 - include: pre_requisite.yml
+- include: selinux.yml
+  when: ansible_os_family == 'RedHat'
+
 - include: fetch_configs.yml
 - include: start_docker_rgw.yml

roles/ceph-rgw/tasks/docker/selinux.yml

@@ -0,0 +1,13 @@
+---
+- name: check if selinux is enabled
+  command: getenforce
+  register: sestatus
+  changed_when: false
+
+- name: set selinux permissions
+  shell: chcon -Rt svirt_sandbox_file_t {{ item }}
+  with_items:
+    - /etc/ceph
+    - /var/lib/ceph
+  changed_when: false
+  when: sestatus.stdout != 'Disabled'