From 786efc258b9fb6286eb7fc2b805cd3b79d0562f5 Mon Sep 17 00:00:00 2001 From: AnsibleRoles <> Date: Sun, 6 Dec 2020 05:02:43 +0000 Subject: [PATCH 01/21] Initial commit --- .gitignore | 414 +++++++++++++++++++++++++++++++++++++++++++++++++++++ README.md | 2 + 2 files changed, 416 insertions(+) create mode 100644 .gitignore create mode 100644 README.md diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..095f500 --- /dev/null +++ b/.gitignore @@ -0,0 +1,414 @@ +# ---> Ansible +*.retry + +# ---> Linux +*~ + +# temporary files which can be created if a process still has a handle open of a deleted file +.fuse_hidden* + +# KDE directory preferences +.directory + +# Linux trash folder which might appear on any partition or disk +.Trash-* + +# .nfs files are created when an open file is removed but is still being accessed +.nfs* + +# ---> Windows +# Windows thumbnail cache files +Thumbs.db +ehthumbs.db +ehthumbs_vista.db + +# Dump file +*.stackdump + +# Folder config file +[Dd]esktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Windows Installer files +*.cab +*.msi +*.msix +*.msm +*.msp + +# Windows shortcuts +*.lnk + +# ---> macOS +# General +.DS_Store +.AppleDouble +.LSOverride + +# Icon must end with two \r +Icon + +# Thumbnails +._* + +# Files that might appear in the root of a volume +.DocumentRevisions-V100 +.fseventsd +.Spotlight-V100 +.TemporaryItems +.Trashes +.VolumeIcon.icns +.com.apple.timemachine.donotpresent + +# Directories potentially created on remote AFP share +.AppleDB +.AppleDesktop +Network Trash Folder +Temporary Items +.apdisk + +# ---> VisualStudio +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +bld/ +[Bb]in/ +[Oo]bj/ +[Ll]og/ + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUNIT +*.VisualState.xml +TestResult.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# JustCode is a .NET coding add-in +.JustCode + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# JetBrains Rider +.idea/ +*.sln.iml + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# ---> VisualStudioCode +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json + diff --git a/README.md b/README.md new file mode 100644 index 0000000..9d94ee3 --- /dev/null +++ b/README.md @@ -0,0 +1,2 @@ +# ensure_selinux + From 36568d7d0074509eff25cff9d06223fc5185af14 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sat, 5 Dec 2020 23:07:12 -0600 Subject: [PATCH 02/21] Ansible Role Init --- .travis.yml | 29 ++++++++++++++++++++++++++ README.md | 38 ++++++++++++++++++++++++++++++++- defaults/main.yml | 2 ++ handlers/main.yml | 2 ++ meta/main.yml | 53 +++++++++++++++++++++++++++++++++++++++++++++++ tasks/main.yml | 2 ++ tests/inventory | 2 ++ tests/test.yml | 5 +++++ vars/main.yml | 2 ++ 9 files changed, 134 insertions(+), 1 deletion(-) create mode 100644 .travis.yml create mode 100644 defaults/main.yml create mode 100644 handlers/main.yml create mode 100644 meta/main.yml create mode 100644 tasks/main.yml create mode 100644 tests/inventory create mode 100644 tests/test.yml create mode 100644 vars/main.yml diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/README.md b/README.md index 9d94ee3..225dd44 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,38 @@ -# ensure_selinux +Role Name +========= +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..0b66a03 --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for ensure_selinux \ No newline at end of file diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..cee4ae4 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for ensure_selinux \ No newline at end of file diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..227ad9c --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,53 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.9 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. + \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..45905b8 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# tasks file for ensure_selinux \ No newline at end of file diff --git a/tests/inventory b/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/tests/test.yml b/tests/test.yml new file mode 100644 index 0000000..502e724 --- /dev/null +++ b/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - ensure_selinux \ No newline at end of file diff --git a/vars/main.yml b/vars/main.yml new file mode 100644 index 0000000..e6ae2d5 --- /dev/null +++ b/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for ensure_selinux \ No newline at end of file From 99a92efe44e2cfdeeb979101b313c91f9fa255cb Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sat, 5 Dec 2020 23:53:18 -0600 Subject: [PATCH 03/21] Enable SELinux, by default to enforce the targeted policy --- defaults/main.yml | 5 ++++- tasks/main.yml | 12 +++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 0b66a03..36ad9c9 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,2 +1,5 @@ --- -# defaults file for ensure_selinux \ No newline at end of file +# defaults file for ensure_selinux +selinux_policy: 'targeted' +selinux_state: 'enforcing' + diff --git a/tasks/main.yml b/tasks/main.yml index 45905b8..45ba7d7 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,2 +1,12 @@ --- -# tasks file for ensure_selinux \ No newline at end of file +# tasks file for ensure_selinux +- name: 'Ensure SELinux is enforcing' + ansible.posix.selinux: + policy: '{{ selinux_policy }}' + state: '{{ selinux_state }}' + register: 'results' +- name: 'Reboot if required' + when: + - results.reboot_required + reboot: + From e4f35cd5fd8b32423ced90976608549187d64294 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 25 Jul 2021 04:08:01 +0000 Subject: [PATCH 04/21] Templatize SELinux configuration --- defaults/main.yml | 2 - tasks/main.yml | 110 ++++++++++++++++++++++++++++++++++++- vars/Fedora-34-default.yml | 14 +++++ vars/defaults.yml | 2 + 4 files changed, 123 insertions(+), 5 deletions(-) create mode 100644 vars/Fedora-34-default.yml create mode 100644 vars/defaults.yml diff --git a/defaults/main.yml b/defaults/main.yml index 36ad9c9..e266585 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,5 +1,3 @@ --- # defaults file for ensure_selinux -selinux_policy: 'targeted' -selinux_state: 'enforcing' diff --git a/tasks/main.yml b/tasks/main.yml index 45ba7d7..240496c 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,12 +1,116 @@ --- # tasks file for ensure_selinux -- name: 'Ensure SELinux is enforcing' +- name: 'include variables' + when: + - ansible_system == 'Linux' + include_vars: + file: '{{ lookup("first_found", findme ) }}' + name: 'ensure_selinux' + vars: + findme: + files: + - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' + - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-default.yml' + - '{{ ansible_distribution }}-default.yml' + - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' + - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-default.yml' + - '{{ ansible_os_family }}-default.yml' + - 'default.yml' + paths: + - '../vars/' + errors: 'ignore' +- name: 'package discovery' + when: + - ansible_system == 'Linux' + - packages is not defined + ansible.builtin.package_facts: +- name: 'service discovery' + when: + - ansible_system == 'Linux' + - services is not defined + ansible.builtin.service_facts: +- name: 'ensure packages' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.package_list is defined + - ensure_selinux.package_list is iterable + - packages[item.name] is not defined + ansible.builtin.package: + name: '{{ item.name }}' + state: '{{ item.state }}' + loop: '{{ ensure_selinux.package_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' + notify: + - 'ensure_selinux.package_facts' + - 'ensure_selinux.service_facts' +- name: 'ensure configurations' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.template_list is defined + - ensure_selinux.template_list is iterable + ansible.builtin.template: + backup: 'no' + dest: '{{ item.dest }}' + group: '{{ item.group | default(omit) }}' + mode: '{{ item.mode | default(omit) }}' + owner: '{{ item.owner | default(omit) }}' + selevel: '{{ iteml.selevel | default(omit) }}' + serole: '{{ item.serole | default(omit) }}' + setype: '{{ item.setype | default(omit) }}' + seuser: '{{ item.seuser | default(omit) }}' + src: '{{ item.src }}' + loop: '{{ ensure_selinux.template_list }}' + loop_control: + label: '{{ item.dest }} will be ensured' + notify: + - 'ensure_selinux.package_facts' + - 'ensure_selinux.service_facts' +- name: 'ensure services' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.service_list is defined + - ensure_selinux.service_list is iterable + ansible.builtin.service: + enabled: '{{ item.enabled }}' + name: '{{ item.name }}' + state: '{{ item.state }}' + loop: '{{ ensure_selinux.service_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' + notify: + - 'ensure_selinux.package_facts' + - 'ensure_selinux.service_facts' +- name: 'Ensure SELinux is configured' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.selinux_policy is defined + - ensure_selinux.selinux_state is defined ansible.posix.selinux: - policy: '{{ selinux_policy }}' - state: '{{ selinux_state }}' + policy: '{{ ensure_selinux.selinux_policy }}' + state: '{{ ensure_selinux.selinux_state }}' register: 'results' - name: 'Reboot if required' when: - results.reboot_required reboot: +- name: 'ensure seboolean' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.seboolean_list is defined + - ensure_selinux.seboolean_list is iterable + ansible.posix.seboolean: + name: '{{ item.name }}' + persistent: '{{ item.persistent }}' + state: '{{ item.state }}' + loop: '{{ ensure_selinux.seboolean_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' +- name: 'flush handlers' + meta: 'flush_handlers' diff --git a/vars/Fedora-34-default.yml b/vars/Fedora-34-default.yml new file mode 100644 index 0000000..e3f439a --- /dev/null +++ b/vars/Fedora-34-default.yml @@ -0,0 +1,14 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +seboolean_list: + - name: 'antivirus_can_scan_system' + persistent: 'yes' + state: 'yes' +selinux_policy: 'targeted' +selinux_state: 'enforcing' + diff --git a/vars/defaults.yml b/vars/defaults.yml new file mode 100644 index 0000000..e6ae2d5 --- /dev/null +++ b/vars/defaults.yml @@ -0,0 +1,2 @@ +--- +# vars file for ensure_selinux \ No newline at end of file From 4ca5ddfe6809837a2f2c59abec5c5e967c504010 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Fri, 5 Nov 2021 21:54:53 -0500 Subject: [PATCH 05/21] Rename defaults so that unknown target OS have no change --- vars/{defaults.yml => default.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename vars/{defaults.yml => default.yml} (100%) diff --git a/vars/defaults.yml b/vars/default.yml similarity index 100% rename from vars/defaults.yml rename to vars/default.yml From 810a6c47a22077f58de1da4e5010f82f6c74c37d Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 7 Nov 2021 10:29:49 -0600 Subject: [PATCH 06/21] Add missing when clause to reboot requests --- tasks/main.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tasks/main.yml b/tasks/main.yml index 240496c..094826e 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -96,6 +96,12 @@ register: 'results' - name: 'Reboot if required' when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.selinux_policy is defined + - ensure_selinux.selinux_state is defined + - results is defined + - results.reboot_required is defined - results.reboot_required reboot: - name: 'ensure seboolean' From 281d958bd4b4904242ea47aa531c9ea548bab46b Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 7 Nov 2021 22:54:22 -0600 Subject: [PATCH 07/21] Enable Fedora 35, remove clamav config in favor of clamav role --- vars/Fedora-34-default.yml | 5 ----- vars/Fedora-35-default.yml | 9 +++++++++ 2 files changed, 9 insertions(+), 5 deletions(-) create mode 100644 vars/Fedora-35-default.yml diff --git a/vars/Fedora-34-default.yml b/vars/Fedora-34-default.yml index e3f439a..b16597b 100644 --- a/vars/Fedora-34-default.yml +++ b/vars/Fedora-34-default.yml @@ -5,10 +5,5 @@ package_list: state: 'present' - name: 'python3-libsemanage' state: 'present' -seboolean_list: - - name: 'antivirus_can_scan_system' - persistent: 'yes' - state: 'yes' selinux_policy: 'targeted' selinux_state: 'enforcing' - diff --git a/vars/Fedora-35-default.yml b/vars/Fedora-35-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-35-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 7482ed1dd4b57a3685f735bdd01ac73339e49946 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 5 Jun 2022 12:20:19 -0500 Subject: [PATCH 08/21] Add Fedora 36 --- vars/Fedora-36-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-36-default.yml diff --git a/vars/Fedora-36-default.yml b/vars/Fedora-36-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-36-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 6044ac3c4368e4bc89b94a3f16dbf7531ddecf1f Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 5 Jun 2022 16:30:12 -0500 Subject: [PATCH 09/21] Update handlers --- handlers/main.yml | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/handlers/main.yml b/handlers/main.yml index cee4ae4..6194320 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -1,2 +1,27 @@ --- -# handlers file for ensure_selinux \ No newline at end of file +# handlers file for ensure_selinux +- name: 'ensure_selinux.package_facts' + ansible.builtin.package_facts: +- name: 'ensure_selinux.service_facts' + ansible.builtin.service_facts: +- name: 'ensure_selinux.service_reload' + when: + - ansible_system == 'Linux' + - ansible_service_mgr == 'systemd' + - ensure_selinux is defined + ansible.builtin.systemd: + daemon_reload: 'yes' +- name: 'ensure_selinux.services' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.service_list is defined + - ensure_selinux.service_list is iterable + - item.state == 'started' + ansible.builtin.service: + enabled: '{{ item.enabled }}' + name: '{{ item.name }}' + state: 'restarted' + loop: '{{ ensure_selinux.service_list }}' + loop_control: + label: '{{ item.name }} will be restarted' From 33b77ba1c068f12e920b4e1777014e157a10f6ef Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 5 Jun 2022 16:48:40 -0500 Subject: [PATCH 10/21] Update tasks --- tasks/main.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/tasks/main.yml b/tasks/main.yml index 094826e..66fd386 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -35,7 +35,6 @@ - ensure_selinux is defined - ensure_selinux.package_list is defined - ensure_selinux.package_list is iterable - - packages[item.name] is not defined ansible.builtin.package: name: '{{ item.name }}' state: '{{ item.state }}' From 06d4b49d8e3170cc36e1acbcbc306489c2466820 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 6 Dec 2022 21:35:12 -0600 Subject: [PATCH 11/21] Add Fedora 37 --- vars/Fedora-37-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-37-default.yml diff --git a/vars/Fedora-37-default.yml b/vars/Fedora-37-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-37-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 2b2c75bbe1fd5a7431e0e8e1ad86904c0b83d027 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 23 Apr 2023 16:42:55 -0500 Subject: [PATCH 12/21] Add Fedora 38 --- vars/Fedora-38-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-38-default.yml diff --git a/vars/Fedora-38-default.yml b/vars/Fedora-38-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-38-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From e8ace75b424193651c98140a3cbc31f9fc272c9b Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sat, 16 Mar 2024 20:24:36 -0500 Subject: [PATCH 13/21] Add Fedora 39 --- vars/Fedora-39-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-39-default.yml diff --git a/vars/Fedora-39-default.yml b/vars/Fedora-39-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-39-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 4b135b0c4359948c06e4aaf0ee9108c8a9f973fa Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 2 Jun 2024 12:26:49 -0500 Subject: [PATCH 14/21] Fedora 40 support Signed-off-by: Jason Rothstein --- vars/Fedora-40-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-40-default.yml diff --git a/vars/Fedora-40-default.yml b/vars/Fedora-40-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-40-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 8e919868e9505271ddbf605e47366d640ea1fbd9 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Fri, 27 Dec 2024 15:54:53 -0600 Subject: [PATCH 15/21] Fedora 41 Signed-off-by: Jason Rothstein --- vars/Fedora-41-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-41-default.yml diff --git a/vars/Fedora-41-default.yml b/vars/Fedora-41-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-41-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 2910df6a20b7cf253739708630d2bd8e9d4be44b Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 27 Apr 2025 12:48:16 -0500 Subject: [PATCH 16/21] Fedora 42 Signed-off-by: Jason Rothstein --- vars/Fedora-42-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-42-default.yml diff --git a/vars/Fedora-42-default.yml b/vars/Fedora-42-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-42-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 338b51fb7abf78e0fc7e3a3c81519dcb5a632f64 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 25 May 2025 20:13:45 -0500 Subject: [PATCH 17/21] Handler improvements Signed-off-by: Jason Rothstein --- handlers/main.yml | 4 +++- tasks/main.yml | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/handlers/main.yml b/handlers/main.yml index 6194320..6293062 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -11,7 +11,7 @@ - ensure_selinux is defined ansible.builtin.systemd: daemon_reload: 'yes' -- name: 'ensure_selinux.services' +- name: 'ensure_selinux.service_restart' when: - ansible_system == 'Linux' - ensure_selinux is defined @@ -25,3 +25,5 @@ loop: '{{ ensure_selinux.service_list }}' loop_control: label: '{{ item.name }} will be restarted' +... + diff --git a/tasks/main.yml b/tasks/main.yml index 66fd386..422c2ab 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -67,6 +67,8 @@ notify: - 'ensure_selinux.package_facts' - 'ensure_selinux.service_facts' + - 'ensure_selinux.service_reload' + - 'ensure_selinux.service_restart' - name: 'ensure services' when: - ansible_system == 'Linux' @@ -118,4 +120,5 @@ label: '{{ item.name }} will be {{ item.state }}' - name: 'flush handlers' meta: 'flush_handlers' +... From ca025bc614ac302d2e8849f80c96320486c49781 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Thu, 30 Apr 2026 19:45:01 -0500 Subject: [PATCH 18/21] Fedora 43, 44 Signed-off-by: Jason Rothstein --- vars/Fedora-43-default.yml | 9 +++++++++ vars/Fedora-44-default.yml | 9 +++++++++ 2 files changed, 18 insertions(+) create mode 100644 vars/Fedora-43-default.yml create mode 100644 vars/Fedora-44-default.yml diff --git a/vars/Fedora-43-default.yml b/vars/Fedora-43-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-43-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Fedora-44-default.yml b/vars/Fedora-44-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-44-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From f9ad1bab85ea78df9539b8fc025b4f0a8a653bd7 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 5 May 2026 14:10:43 -0500 Subject: [PATCH 19/21] Fix ansible core 2.20 and supported OS list Signed-off-by: Jason Rothstein --- tasks/main.yml | 30 +++++++++---------- ...4-default.yml => AlmaLinux-10-default.yml} | 0 ...35-default.yml => AlmaLinux-8-default.yml} | 0 ...36-default.yml => AlmaLinux-9-default.yml} | 0 ...a-37-default.yml => CentOS-10-default.yml} | 0 ...ra-38-default.yml => CentOS-8-default.yml} | 0 ...ra-39-default.yml => CentOS-9-default.yml} | 0 ...default.yml => OracleLinux-10-default.yml} | 0 ...-default.yml => OracleLinux-8-default.yml} | 0 vars/OracleLinux-9-default.yml | 9 ++++++ vars/Rocky-10-default.yml | 9 ++++++ vars/Rocky-8-default.yml | 9 ++++++ vars/Rocky-9-default.yml | 9 ++++++ 13 files changed, 51 insertions(+), 15 deletions(-) rename vars/{Fedora-34-default.yml => AlmaLinux-10-default.yml} (100%) rename vars/{Fedora-35-default.yml => AlmaLinux-8-default.yml} (100%) rename vars/{Fedora-36-default.yml => AlmaLinux-9-default.yml} (100%) rename vars/{Fedora-37-default.yml => CentOS-10-default.yml} (100%) rename vars/{Fedora-38-default.yml => CentOS-8-default.yml} (100%) rename vars/{Fedora-39-default.yml => CentOS-9-default.yml} (100%) rename vars/{Fedora-40-default.yml => OracleLinux-10-default.yml} (100%) rename vars/{Fedora-41-default.yml => OracleLinux-8-default.yml} (100%) create mode 100644 vars/OracleLinux-9-default.yml create mode 100644 vars/Rocky-10-default.yml create mode 100644 vars/Rocky-8-default.yml create mode 100644 vars/Rocky-9-default.yml diff --git a/tasks/main.yml b/tasks/main.yml index 422c2ab..7f4b7a2 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -2,18 +2,18 @@ # tasks file for ensure_selinux - name: 'include variables' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' include_vars: file: '{{ lookup("first_found", findme ) }}' name: 'ensure_selinux' vars: findme: files: - - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' - - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-default.yml' - - '{{ ansible_distribution }}-default.yml' - - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' - - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-default.yml' + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' + - '{{ ansible_facts["distribution"] }}-default.yml' + - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_os_family }}-default.yml' - 'default.yml' paths: @@ -21,17 +21,17 @@ errors: 'ignore' - name: 'package discovery' when: - - ansible_system == 'Linux' - - packages is not defined + - ansible_facts["system"] == 'Linux' + - ansible_facts["packages"] is not defined ansible.builtin.package_facts: - name: 'service discovery' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - services is not defined ansible.builtin.service_facts: - name: 'ensure packages' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.package_list is defined - ensure_selinux.package_list is iterable @@ -46,7 +46,7 @@ - 'ensure_selinux.service_facts' - name: 'ensure configurations' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.template_list is defined - ensure_selinux.template_list is iterable @@ -71,7 +71,7 @@ - 'ensure_selinux.service_restart' - name: 'ensure services' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.service_list is defined - ensure_selinux.service_list is iterable @@ -87,7 +87,7 @@ - 'ensure_selinux.service_facts' - name: 'Ensure SELinux is configured' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.selinux_policy is defined - ensure_selinux.selinux_state is defined @@ -97,7 +97,7 @@ register: 'results' - name: 'Reboot if required' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.selinux_policy is defined - ensure_selinux.selinux_state is defined @@ -107,7 +107,7 @@ reboot: - name: 'ensure seboolean' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.seboolean_list is defined - ensure_selinux.seboolean_list is iterable diff --git a/vars/Fedora-34-default.yml b/vars/AlmaLinux-10-default.yml similarity index 100% rename from vars/Fedora-34-default.yml rename to vars/AlmaLinux-10-default.yml diff --git a/vars/Fedora-35-default.yml b/vars/AlmaLinux-8-default.yml similarity index 100% rename from vars/Fedora-35-default.yml rename to vars/AlmaLinux-8-default.yml diff --git a/vars/Fedora-36-default.yml b/vars/AlmaLinux-9-default.yml similarity index 100% rename from vars/Fedora-36-default.yml rename to vars/AlmaLinux-9-default.yml diff --git a/vars/Fedora-37-default.yml b/vars/CentOS-10-default.yml similarity index 100% rename from vars/Fedora-37-default.yml rename to vars/CentOS-10-default.yml diff --git a/vars/Fedora-38-default.yml b/vars/CentOS-8-default.yml similarity index 100% rename from vars/Fedora-38-default.yml rename to vars/CentOS-8-default.yml diff --git a/vars/Fedora-39-default.yml b/vars/CentOS-9-default.yml similarity index 100% rename from vars/Fedora-39-default.yml rename to vars/CentOS-9-default.yml diff --git a/vars/Fedora-40-default.yml b/vars/OracleLinux-10-default.yml similarity index 100% rename from vars/Fedora-40-default.yml rename to vars/OracleLinux-10-default.yml diff --git a/vars/Fedora-41-default.yml b/vars/OracleLinux-8-default.yml similarity index 100% rename from vars/Fedora-41-default.yml rename to vars/OracleLinux-8-default.yml diff --git a/vars/OracleLinux-9-default.yml b/vars/OracleLinux-9-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/OracleLinux-9-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Rocky-10-default.yml b/vars/Rocky-10-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Rocky-10-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Rocky-8-default.yml b/vars/Rocky-8-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Rocky-8-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Rocky-9-default.yml b/vars/Rocky-9-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Rocky-9-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From abb2885a98e784408230484d84e2df32eaa2230a Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 5 May 2026 15:03:03 -0500 Subject: [PATCH 20/21] More ansible core 2.20 fixes Signed-off-by: Jason Rothstein --- tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tasks/main.yml b/tasks/main.yml index 7f4b7a2..4dcbc00 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -9,10 +9,10 @@ vars: findme: files: - - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_facts["distribution"] }}-default.yml' - - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_os_family }}-default.yml' - 'default.yml' From 3df6ef38ce8e94aad5718d5641a2bcc3a14a806f Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 5 May 2026 18:17:39 -0500 Subject: [PATCH 21/21] More ansible core 2.20 fixes Signed-off-by: Jason Rothstein --- handlers/main.yml | 6 +++--- tasks/main.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/handlers/main.yml b/handlers/main.yml index 6293062..b3a862e 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -6,14 +6,14 @@ ansible.builtin.service_facts: - name: 'ensure_selinux.service_reload' when: - - ansible_system == 'Linux' - - ansible_service_mgr == 'systemd' + - ansible_facts["system"] == 'Linux' + - ansible_facts["service_mgr"] == 'systemd' - ensure_selinux is defined ansible.builtin.systemd: daemon_reload: 'yes' - name: 'ensure_selinux.service_restart' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.service_list is defined - ensure_selinux.service_list is iterable diff --git a/tasks/main.yml b/tasks/main.yml index 4dcbc00..80a7307 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -12,9 +12,9 @@ - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_facts["distribution"] }}-default.yml' - - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - - '{{ ansible_os_family }}-default.yml' + - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' + - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' + - '{{ ansible_facts["os_family"] }}-default.yml' - 'default.yml' paths: - '../vars/' @@ -27,7 +27,7 @@ - name: 'service discovery' when: - ansible_facts["system"] == 'Linux' - - services is not defined + - ansible_facts["services"] is not defined ansible.builtin.service_facts: - name: 'ensure packages' when: