seport: add local argument

[bachradsusi]

Using local: true users can enforce to work only with local policy
modifications. i.e.

# Without `local`, no new modification is added when port already exists
$ sudo ansible -m seport -a 'ports=22 state=present setype=ssh_port_t proto=tcp' localhost

localhost | SUCCESS => {
    "changed": false,
    "ports": [
        "22"
    ],
    "proto": "tcp",
    "setype": "ssh_port_t",
    "state": "present"
}

$ sudo semanage port -l -C

# With `local`, a port is always added/changed in local modification list
$ sudo ansible -m seport -a 'ports=22 state=present setype=ssh_port_t proto=tcp local=true' localhost

localhost | CHANGED => {
    "changed": true,
    "ports": [
        "22"
    ],
    "proto": "tcp",
    "setype": "ssh_port_t",
    "state": "present"
}

$ sudo semanage port -l -C
SELinux Port Type              Proto    Port Number

ssh_port_t                     tcp      22

# With `local`, seport removes the port only from local modifications
$ sudo ansible -m seport -a 'ports=22 state=absent setype=ssh_port_t proto=tcp local=true' localhost

localhost | CHANGED => {
    "changed": true,
    "ports": [
        "22"
    ],
    "proto": "tcp",
    "setype": "ssh_port_t",
    "state": "absent"
}

$ sudo semanage port -l -C

# Even though the port is still defined in system policy, the module
# result is success as there's no port local modification
$ sudo ansible -m seport -a 'ports=22 state=absent setype=ssh_port_t proto=tcp local=true' localhost

localhost | SUCCESS => {
    "changed": false,
    "ports": [
        "22"
    ],
    "proto": "tcp",
    "setype": "ssh_port_t",
    "state": "absent"
}

# But it fails without `local` as it tries to remove port defined in
# system policy
$ sudo ansible -m seport -a 'ports=22 state=absent setype=ssh_port_t proto=tcp' localhost

An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ValueError: Port tcp/22 is defined in policy, cannot be deleted
localhost | FAILED! => {
    "changed": false,
    "msg": "ValueError: Port tcp/22 is defined in policy, cannot be deleted\n"
}

Signed-off-by: Petr Lautrbach [email protected]

SUMMARY

ISSUE TYPE

• Bugfix Pull Request
• Docs Pull Request
• Feature Pull Request
• New Module Pull Request

COMPONENT NAME

ADDITIONAL INFORMATION

[ansibullbot]

cc @dankeder
click here for bot help

[github-actions]

Docs Build 📝

Thank you for contribution!✨

This PR has been merged and your docs changes will be incorporated when they are next published.

[felixfontein]

Thanks for your contribution! Could you please add a changelog fragment? Thanks.

[bachradsusi]

I believe I've resolved all comments in the latest push.

[patchback]

Backport to stable-5: 💚 backport PR created

✅ Backport PR branch: patchback/backports/stable-5/4c52fdb9d91bc4b6293fcf6273d38f24e3b886aa/pr-5203

Backported as #5218

🤖 @patchback
I'm built with octomachinery and
my source is open — https://github.com/sanitizers/patchback-github-app.

[felixfontein]

@bachradsusi thanks for implementing this!
@richm thanks for reviewing!