Why do these SELinux tasks report "changed" every time?

[Willard Dennis]

Hi all,

I have two tasks in a playbook as follows:

- name: RHELFAM | Set SELinux to permissive

  selinux: policy=targeted state=permissive

  tags: secmods

- name: RHELFAM | Disable SELinux in conf file

  selinux: state=disabled

  tags: secmods

Each time they run, even if the target machine is in the desired state, the task returns "changed"... Why would that be?

Thanks,

Will

[Brian Coca]

well, i would expect one if not both to always return changed, I
looked at the module code and it does compare against existing state
to determine change status


--
Brian Coca

[Willard Dennis]

Ah, I see what you mean... the first one has state=permissive, and the next state=disabled... So they were just bouncing back and forth... D'oh!

I guess that's why folks suggest code review as a best practice ;)

Thanks!

Will