selinux modules don't change SELINUXTYPE when it's not exist in /etc/selinux/config.

[nfwork01]

SUMMARY

SELinux moduled does not add new SELINUXTYPE line in /etc/selinux/config when that line does not exits.

ISSUE TYPE

• Bug Report

COMPONENT NAME

selinux

ANSIBLE VERSION

ansible 2.9.7                                                                                                                                                                                               python version = 3.8.2 (default, Mar 13 2020, 10:14:16) [GCC 9.3.0]

CONFIGURATION

Ansible tasks

- name: "1.6.1.2 - Ensure the SELinux state is enforcing"
  selinux:
    policy: targeted
    state: enforcing
  register: tmp

# For detailed information, no need for production.
- debug:
    msg: "{{ tmp }}"

/etc/selinux/config

# No SELINUXTYPE setting on the conf file
# selinux module works well when the line exists.
SELINUX=disabled

EXPECTED RESULTS

/etc/selinux/config

SELINUX=enforcing
SELINUXTYPE=targeted

ACTUAL RESULTS

/etc/selinux/config

SELINUX=enforcing

tasks log

TASK [cis_rhel7 : 1.6.1.2 - Ensure the SELinux state is enforcing] [WARNING]: Reboot is required to set SELinux state to 'enforcing'
changed: [10.0.0.129]

TASK [cis_rhel7 : debug] *********************************************************************************************************************************************************************************************************************************************************************************************************************************************************************
ok: [10.0.0.129] => {
    "msg": {
        "changed": true,
        "configfile": "/etc/selinux/config",
        "failed": false,
        "msg": "SELinux policy configuration in '/etc/selinux/config' changed from 'None' to 'targeted'",
        "policy": "targeted",
        "reboot_required": true,
        "state": "enforcing",
        "warnings": [
            "Reboot is required to set SELinux state to 'enforcing'"
        ]
    }
}

task log says "policy was changed to targeted" but not reflected to the config file.

[maxamillion]

Fixed here: #52