From f60ec08a4fe1e14a4a6e01125d9ac6e60b187e1e Mon Sep 17 00:00:00 2001 From: AnsibleRoles <> Date: Sun, 6 Dec 2020 05:02:43 +0000 Subject: [PATCH 01/21] Initial commit --- .gitignore | 414 +++++++++++++++++++++++++++++++++++++++++++++++++++++ LICENSE | 163 +++++++++++++++++++++ README.md | 2 + 3 files changed, 579 insertions(+) create mode 100644 .gitignore create mode 100644 LICENSE create mode 100644 README.md diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..095f500 --- /dev/null +++ b/.gitignore @@ -0,0 +1,414 @@ +# ---> Ansible +*.retry + +# ---> Linux +*~ + +# temporary files which can be created if a process still has a handle open of a deleted file +.fuse_hidden* + +# KDE directory preferences +.directory + +# Linux trash folder which might appear on any partition or disk +.Trash-* + +# .nfs files are created when an open file is removed but is still being accessed +.nfs* + +# ---> Windows +# Windows thumbnail cache files +Thumbs.db +ehthumbs.db +ehthumbs_vista.db + +# Dump file +*.stackdump + +# Folder config file +[Dd]esktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Windows Installer files +*.cab +*.msi +*.msix +*.msm +*.msp + +# Windows shortcuts +*.lnk + +# ---> macOS +# General +.DS_Store +.AppleDouble +.LSOverride + +# Icon must end with two \r +Icon + +# Thumbnails +._* + +# Files that might appear in the root of a volume +.DocumentRevisions-V100 +.fseventsd +.Spotlight-V100 +.TemporaryItems +.Trashes +.VolumeIcon.icns +.com.apple.timemachine.donotpresent + +# Directories potentially created on remote AFP share +.AppleDB +.AppleDesktop +Network Trash Folder +Temporary Items +.apdisk + +# ---> VisualStudio +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +bld/ +[Bb]in/ +[Oo]bj/ +[Ll]og/ + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUNIT +*.VisualState.xml +TestResult.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# JustCode is a .NET coding add-in +.JustCode + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# JetBrains Rider +.idea/ +*.sln.iml + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# ---> VisualStudioCode +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json + diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..1344add --- /dev/null +++ b/LICENSE @@ -0,0 +1,163 @@ +GNU LESSER GENERAL PUBLIC LICENSE + +Version 3, 29 June 2007 + +Copyright (C) 2007 Free Software Foundation, Inc. + +Everyone is permitted to copy and distribute verbatim copies of this license +document, but changing it is not allowed. + +This version of the GNU Lesser General Public License incorporates the terms +and conditions of version 3 of the GNU General Public License, supplemented +by the additional permissions listed below. + + 0. Additional Definitions. + + + +As used herein, "this License" refers to version 3 of the GNU Lesser General +Public License, and the "GNU GPL" refers to version 3 of the GNU General Public +License. + + + +"The Library" refers to a covered work governed by this License, other than +an Application or a Combined Work as defined below. + + + +An "Application" is any work that makes use of an interface provided by the +Library, but which is not otherwise based on the Library. Defining a subclass +of a class defined by the Library is deemed a mode of using an interface provided +by the Library. + + + +A "Combined Work" is a work produced by combining or linking an Application +with the Library. The particular version of the Library with which the Combined +Work was made is also called the "Linked Version". + + + +The "Minimal Corresponding Source" for a Combined Work means the Corresponding +Source for the Combined Work, excluding any source code for portions of the +Combined Work that, considered in isolation, are based on the Application, +and not on the Linked Version. + + + +The "Corresponding Application Code" for a Combined Work means the object +code and/or source code for the Application, including any data and utility +programs needed for reproducing the Combined Work from the Application, but +excluding the System Libraries of the Combined Work. + + 1. Exception to Section 3 of the GNU GPL. + +You may convey a covered work under sections 3 and 4 of this License without +being bound by section 3 of the GNU GPL. + + 2. Conveying Modified Versions. + +If you modify a copy of the Library, and, in your modifications, a facility +refers to a function or data to be supplied by an Application that uses the +facility (other than as an argument passed when the facility is invoked), +then you may convey a copy of the modified version: + +a) under this License, provided that you make a good faith effort to ensure +that, in the event an Application does not supply the function or data, the +facility still operates, and performs whatever part of its purpose remains +meaningful, or + +b) under the GNU GPL, with none of the additional permissions of this License +applicable to that copy. + + 3. Object Code Incorporating Material from Library Header Files. + +The object code form of an Application may incorporate material from a header +file that is part of the Library. You may convey such object code under terms +of your choice, provided that, if the incorporated material is not limited +to numerical parameters, data structure layouts and accessors, or small macros, +inline functions and templates (ten or fewer lines in length), you do both +of the following: + +a) Give prominent notice with each copy of the object code that the Library +is used in it and that the Library and its use are covered by this License. + +b) Accompany the object code with a copy of the GNU GPL and this license document. + + 4. Combined Works. + +You may convey a Combined Work under terms of your choice that, taken together, +effectively do not restrict modification of the portions of the Library contained +in the Combined Work and reverse engineering for debugging such modifications, +if you also do each of the following: + +a) Give prominent notice with each copy of the Combined Work that the Library +is used in it and that the Library and its use are covered by this License. + +b) Accompany the Combined Work with a copy of the GNU GPL and this license +document. + +c) For a Combined Work that displays copyright notices during execution, include +the copyright notice for the Library among these notices, as well as a reference +directing the user to the copies of the GNU GPL and this license document. + + d) Do one of the following: + +0) Convey the Minimal Corresponding Source under the terms of this License, +and the Corresponding Application Code in a form suitable for, and under terms +that permit, the user to recombine or relink the Application with a modified +version of the Linked Version to produce a modified Combined Work, in the +manner specified by section 6 of the GNU GPL for conveying Corresponding Source. + +1) Use a suitable shared library mechanism for linking with the Library. A +suitable mechanism is one that (a) uses at run time a copy of the Library +already present on the user's computer system, and (b) will operate properly +with a modified version of the Library that is interface-compatible with the +Linked Version. + +e) Provide Installation Information, but only if you would otherwise be required +to provide such information under section 6 of the GNU GPL, and only to the +extent that such information is necessary to install and execute a modified +version of the Combined Work produced by recombining or relinking the Application +with a modified version of the Linked Version. (If you use option 4d0, the +Installation Information must accompany the Minimal Corresponding Source and +Corresponding Application Code. If you use option 4d1, you must provide the +Installation Information in the manner specified by section 6 of the GNU GPL +for conveying Corresponding Source.) + + 5. Combined Libraries. + +You may place library facilities that are a work based on the Library side +by side in a single library together with other library facilities that are +not Applications and are not covered by this License, and convey such a combined +library under terms of your choice, if you do both of the following: + +a) Accompany the combined library with a copy of the same work based on the +Library, uncombined with any other library facilities, conveyed under the +terms of this License. + +b) Give prominent notice with the combined library that part of it is a work +based on the Library, and explaining where to find the accompanying uncombined +form of the same work. + + 6. Revised Versions of the GNU Lesser General Public License. + +The Free Software Foundation may publish revised and/or new versions of the +GNU Lesser General Public License from time to time. Such new versions will +be similar in spirit to the present version, but may differ in detail to address +new problems or concerns. + +Each version is given a distinguishing version number. If the Library as you +received it specifies that a certain numbered version of the GNU Lesser General +Public License "or any later version" applies to it, you have the option of +following the terms and conditions either of that published version or of +any later version published by the Free Software Foundation. If the Library +as you received it does not specify a version number of the GNU Lesser General +Public License, you may choose any version of the GNU Lesser General Public +License ever published by the Free Software Foundation. + +If the Library as you received it specifies that a proxy can decide whether +future versions of the GNU Lesser General Public License shall apply, that +proxy's public statement of acceptance of any version is permanent authorization +for you to choose that version for the Library. diff --git a/README.md b/README.md new file mode 100644 index 0000000..9d94ee3 --- /dev/null +++ b/README.md @@ -0,0 +1,2 @@ +# ensure_selinux + From b5514e941511127da1de1e1c35b3eae1d5feb06d Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sat, 5 Dec 2020 23:07:12 -0600 Subject: [PATCH 02/21] Ansible Role Init --- .travis.yml | 29 ++++++++++++++++++++++++++ README.md | 38 ++++++++++++++++++++++++++++++++- defaults/main.yml | 2 ++ handlers/main.yml | 2 ++ meta/main.yml | 53 +++++++++++++++++++++++++++++++++++++++++++++++ tasks/main.yml | 2 ++ tests/inventory | 2 ++ tests/test.yml | 5 +++++ vars/main.yml | 2 ++ 9 files changed, 134 insertions(+), 1 deletion(-) create mode 100644 .travis.yml create mode 100644 defaults/main.yml create mode 100644 handlers/main.yml create mode 100644 meta/main.yml create mode 100644 tasks/main.yml create mode 100644 tests/inventory create mode 100644 tests/test.yml create mode 100644 vars/main.yml diff --git a/.travis.yml b/.travis.yml new file mode 100644 index 0000000..36bbf62 --- /dev/null +++ b/.travis.yml @@ -0,0 +1,29 @@ +--- +language: python +python: "2.7" + +# Use the new container infrastructure +sudo: false + +# Install ansible +addons: + apt: + packages: + - python-pip + +install: + # Install ansible + - pip install ansible + + # Check ansible version + - ansible --version + + # Create ansible.cfg with correct roles_path + - printf '[defaults]\nroles_path=../' >ansible.cfg + +script: + # Basic role syntax check + - ansible-playbook tests/test.yml -i tests/inventory --syntax-check + +notifications: + webhooks: https://galaxy.ansible.com/api/v1/notifications/ \ No newline at end of file diff --git a/README.md b/README.md index 9d94ee3..225dd44 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,38 @@ -# ensure_selinux +Role Name +========= +A brief description of the role goes here. + +Requirements +------------ + +Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required. + +Role Variables +-------------- + +A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well. + +Dependencies +------------ + +A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles. + +Example Playbook +---------------- + +Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too: + + - hosts: servers + roles: + - { role: username.rolename, x: 42 } + +License +------- + +BSD + +Author Information +------------------ + +An optional section for the role authors to include contact information, or a website (HTML is not allowed). diff --git a/defaults/main.yml b/defaults/main.yml new file mode 100644 index 0000000..0b66a03 --- /dev/null +++ b/defaults/main.yml @@ -0,0 +1,2 @@ +--- +# defaults file for ensure_selinux \ No newline at end of file diff --git a/handlers/main.yml b/handlers/main.yml new file mode 100644 index 0000000..cee4ae4 --- /dev/null +++ b/handlers/main.yml @@ -0,0 +1,2 @@ +--- +# handlers file for ensure_selinux \ No newline at end of file diff --git a/meta/main.yml b/meta/main.yml new file mode 100644 index 0000000..227ad9c --- /dev/null +++ b/meta/main.yml @@ -0,0 +1,53 @@ +galaxy_info: + author: your name + description: your role description + company: your company (optional) + + # If the issue tracker for your role is not on github, uncomment the + # next line and provide a value + # issue_tracker_url: http://example.com/issue/tracker + + # Choose a valid license ID from https://spdx.org - some suggested licenses: + # - BSD-3-Clause (default) + # - MIT + # - GPL-2.0-or-later + # - GPL-3.0-only + # - Apache-2.0 + # - CC-BY-4.0 + license: license (GPL-2.0-or-later, MIT, etc) + + min_ansible_version: 2.9 + + # If this a Container Enabled role, provide the minimum Ansible Container version. + # min_ansible_container_version: + + # + # Provide a list of supported platforms, and for each platform a list of versions. + # If you don't wish to enumerate all versions for a particular platform, use 'all'. + # To view available platforms and versions (or releases), visit: + # https://galaxy.ansible.com/api/v1/platforms/ + # + # platforms: + # - name: Fedora + # versions: + # - all + # - 25 + # - name: SomePlatform + # versions: + # - all + # - 1.0 + # - 7 + # - 99.99 + + galaxy_tags: [] + # List tags for your role here, one per line. A tag is a keyword that describes + # and categorizes the role. Users find roles by searching for tags. Be sure to + # remove the '[]' above, if you add tags to this list. + # + # NOTE: A tag is limited to a single word comprised of alphanumeric characters. + # Maximum 20 tags per role. + +dependencies: [] + # List your role dependencies here, one per line. Be sure to remove the '[]' above, + # if you add dependencies to this list. + \ No newline at end of file diff --git a/tasks/main.yml b/tasks/main.yml new file mode 100644 index 0000000..45905b8 --- /dev/null +++ b/tasks/main.yml @@ -0,0 +1,2 @@ +--- +# tasks file for ensure_selinux \ No newline at end of file diff --git a/tests/inventory b/tests/inventory new file mode 100644 index 0000000..878877b --- /dev/null +++ b/tests/inventory @@ -0,0 +1,2 @@ +localhost + diff --git a/tests/test.yml b/tests/test.yml new file mode 100644 index 0000000..502e724 --- /dev/null +++ b/tests/test.yml @@ -0,0 +1,5 @@ +--- +- hosts: localhost + remote_user: root + roles: + - ensure_selinux \ No newline at end of file diff --git a/vars/main.yml b/vars/main.yml new file mode 100644 index 0000000..e6ae2d5 --- /dev/null +++ b/vars/main.yml @@ -0,0 +1,2 @@ +--- +# vars file for ensure_selinux \ No newline at end of file From 5137d9839ef56db565b7a6fe99da712056d678bb Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sat, 5 Dec 2020 23:53:18 -0600 Subject: [PATCH 03/21] Enable SELinux, by default to enforce the targeted policy --- defaults/main.yml | 5 ++++- tasks/main.yml | 12 +++++++++++- 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/defaults/main.yml b/defaults/main.yml index 0b66a03..36ad9c9 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,2 +1,5 @@ --- -# defaults file for ensure_selinux \ No newline at end of file +# defaults file for ensure_selinux +selinux_policy: 'targeted' +selinux_state: 'enforcing' + diff --git a/tasks/main.yml b/tasks/main.yml index 45905b8..45ba7d7 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,2 +1,12 @@ --- -# tasks file for ensure_selinux \ No newline at end of file +# tasks file for ensure_selinux +- name: 'Ensure SELinux is enforcing' + ansible.posix.selinux: + policy: '{{ selinux_policy }}' + state: '{{ selinux_state }}' + register: 'results' +- name: 'Reboot if required' + when: + - results.reboot_required + reboot: + From a9347ec48770bd9134b67e760dd3f7013db7ea9e Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 25 Jul 2021 04:08:01 +0000 Subject: [PATCH 04/21] Templatize SELinux configuration --- defaults/main.yml | 2 - tasks/main.yml | 110 ++++++++++++++++++++++++++++++++++++- vars/Fedora-34-default.yml | 14 +++++ vars/defaults.yml | 2 + 4 files changed, 123 insertions(+), 5 deletions(-) create mode 100644 vars/Fedora-34-default.yml create mode 100644 vars/defaults.yml diff --git a/defaults/main.yml b/defaults/main.yml index 36ad9c9..e266585 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -1,5 +1,3 @@ --- # defaults file for ensure_selinux -selinux_policy: 'targeted' -selinux_state: 'enforcing' diff --git a/tasks/main.yml b/tasks/main.yml index 45ba7d7..240496c 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,12 +1,116 @@ --- # tasks file for ensure_selinux -- name: 'Ensure SELinux is enforcing' +- name: 'include variables' + when: + - ansible_system == 'Linux' + include_vars: + file: '{{ lookup("first_found", findme ) }}' + name: 'ensure_selinux' + vars: + findme: + files: + - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' + - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-default.yml' + - '{{ ansible_distribution }}-default.yml' + - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' + - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-default.yml' + - '{{ ansible_os_family }}-default.yml' + - 'default.yml' + paths: + - '../vars/' + errors: 'ignore' +- name: 'package discovery' + when: + - ansible_system == 'Linux' + - packages is not defined + ansible.builtin.package_facts: +- name: 'service discovery' + when: + - ansible_system == 'Linux' + - services is not defined + ansible.builtin.service_facts: +- name: 'ensure packages' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.package_list is defined + - ensure_selinux.package_list is iterable + - packages[item.name] is not defined + ansible.builtin.package: + name: '{{ item.name }}' + state: '{{ item.state }}' + loop: '{{ ensure_selinux.package_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' + notify: + - 'ensure_selinux.package_facts' + - 'ensure_selinux.service_facts' +- name: 'ensure configurations' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.template_list is defined + - ensure_selinux.template_list is iterable + ansible.builtin.template: + backup: 'no' + dest: '{{ item.dest }}' + group: '{{ item.group | default(omit) }}' + mode: '{{ item.mode | default(omit) }}' + owner: '{{ item.owner | default(omit) }}' + selevel: '{{ iteml.selevel | default(omit) }}' + serole: '{{ item.serole | default(omit) }}' + setype: '{{ item.setype | default(omit) }}' + seuser: '{{ item.seuser | default(omit) }}' + src: '{{ item.src }}' + loop: '{{ ensure_selinux.template_list }}' + loop_control: + label: '{{ item.dest }} will be ensured' + notify: + - 'ensure_selinux.package_facts' + - 'ensure_selinux.service_facts' +- name: 'ensure services' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.service_list is defined + - ensure_selinux.service_list is iterable + ansible.builtin.service: + enabled: '{{ item.enabled }}' + name: '{{ item.name }}' + state: '{{ item.state }}' + loop: '{{ ensure_selinux.service_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' + notify: + - 'ensure_selinux.package_facts' + - 'ensure_selinux.service_facts' +- name: 'Ensure SELinux is configured' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.selinux_policy is defined + - ensure_selinux.selinux_state is defined ansible.posix.selinux: - policy: '{{ selinux_policy }}' - state: '{{ selinux_state }}' + policy: '{{ ensure_selinux.selinux_policy }}' + state: '{{ ensure_selinux.selinux_state }}' register: 'results' - name: 'Reboot if required' when: - results.reboot_required reboot: +- name: 'ensure seboolean' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.seboolean_list is defined + - ensure_selinux.seboolean_list is iterable + ansible.posix.seboolean: + name: '{{ item.name }}' + persistent: '{{ item.persistent }}' + state: '{{ item.state }}' + loop: '{{ ensure_selinux.seboolean_list }}' + loop_control: + label: '{{ item.name }} will be {{ item.state }}' +- name: 'flush handlers' + meta: 'flush_handlers' diff --git a/vars/Fedora-34-default.yml b/vars/Fedora-34-default.yml new file mode 100644 index 0000000..e3f439a --- /dev/null +++ b/vars/Fedora-34-default.yml @@ -0,0 +1,14 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +seboolean_list: + - name: 'antivirus_can_scan_system' + persistent: 'yes' + state: 'yes' +selinux_policy: 'targeted' +selinux_state: 'enforcing' + diff --git a/vars/defaults.yml b/vars/defaults.yml new file mode 100644 index 0000000..e6ae2d5 --- /dev/null +++ b/vars/defaults.yml @@ -0,0 +1,2 @@ +--- +# vars file for ensure_selinux \ No newline at end of file From e07ff951fb165f79a639fc821e7da643f5e5a172 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Fri, 5 Nov 2021 21:54:53 -0500 Subject: [PATCH 05/21] Rename defaults so that unknown target OS have no change --- vars/{defaults.yml => default.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename vars/{defaults.yml => default.yml} (100%) diff --git a/vars/defaults.yml b/vars/default.yml similarity index 100% rename from vars/defaults.yml rename to vars/default.yml From 95d11db0071db7fadcbfa801f88c925a810b8b55 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 7 Nov 2021 10:29:49 -0600 Subject: [PATCH 06/21] Add missing when clause to reboot requests --- tasks/main.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tasks/main.yml b/tasks/main.yml index 240496c..094826e 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -96,6 +96,12 @@ register: 'results' - name: 'Reboot if required' when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.selinux_policy is defined + - ensure_selinux.selinux_state is defined + - results is defined + - results.reboot_required is defined - results.reboot_required reboot: - name: 'ensure seboolean' From 347828a8680534de5a80b385867aa78690aba016 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 7 Nov 2021 22:54:22 -0600 Subject: [PATCH 07/21] Enable Fedora 35, remove clamav config in favor of clamav role --- vars/Fedora-34-default.yml | 5 ----- vars/Fedora-35-default.yml | 9 +++++++++ 2 files changed, 9 insertions(+), 5 deletions(-) create mode 100644 vars/Fedora-35-default.yml diff --git a/vars/Fedora-34-default.yml b/vars/Fedora-34-default.yml index e3f439a..b16597b 100644 --- a/vars/Fedora-34-default.yml +++ b/vars/Fedora-34-default.yml @@ -5,10 +5,5 @@ package_list: state: 'present' - name: 'python3-libsemanage' state: 'present' -seboolean_list: - - name: 'antivirus_can_scan_system' - persistent: 'yes' - state: 'yes' selinux_policy: 'targeted' selinux_state: 'enforcing' - diff --git a/vars/Fedora-35-default.yml b/vars/Fedora-35-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-35-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 0b377009a5b580548923b507ff689f43a0029cef Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 5 Jun 2022 12:20:19 -0500 Subject: [PATCH 08/21] Add Fedora 36 --- vars/Fedora-36-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-36-default.yml diff --git a/vars/Fedora-36-default.yml b/vars/Fedora-36-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-36-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 05a0b4ac687351c744d81873ae3893279e094605 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 5 Jun 2022 16:30:12 -0500 Subject: [PATCH 09/21] Update handlers --- handlers/main.yml | 27 ++++++++++++++++++++++++++- 1 file changed, 26 insertions(+), 1 deletion(-) diff --git a/handlers/main.yml b/handlers/main.yml index cee4ae4..6194320 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -1,2 +1,27 @@ --- -# handlers file for ensure_selinux \ No newline at end of file +# handlers file for ensure_selinux +- name: 'ensure_selinux.package_facts' + ansible.builtin.package_facts: +- name: 'ensure_selinux.service_facts' + ansible.builtin.service_facts: +- name: 'ensure_selinux.service_reload' + when: + - ansible_system == 'Linux' + - ansible_service_mgr == 'systemd' + - ensure_selinux is defined + ansible.builtin.systemd: + daemon_reload: 'yes' +- name: 'ensure_selinux.services' + when: + - ansible_system == 'Linux' + - ensure_selinux is defined + - ensure_selinux.service_list is defined + - ensure_selinux.service_list is iterable + - item.state == 'started' + ansible.builtin.service: + enabled: '{{ item.enabled }}' + name: '{{ item.name }}' + state: 'restarted' + loop: '{{ ensure_selinux.service_list }}' + loop_control: + label: '{{ item.name }} will be restarted' From 84b037cefc64abfec38fc87ac5943176a00e7e50 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 5 Jun 2022 16:48:40 -0500 Subject: [PATCH 10/21] Update tasks --- tasks/main.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/tasks/main.yml b/tasks/main.yml index 094826e..66fd386 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -35,7 +35,6 @@ - ensure_selinux is defined - ensure_selinux.package_list is defined - ensure_selinux.package_list is iterable - - packages[item.name] is not defined ansible.builtin.package: name: '{{ item.name }}' state: '{{ item.state }}' From 3c08bb873169de0926e1801b6f46bef189b8b94c Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 6 Dec 2022 21:35:12 -0600 Subject: [PATCH 11/21] Add Fedora 37 --- vars/Fedora-37-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-37-default.yml diff --git a/vars/Fedora-37-default.yml b/vars/Fedora-37-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-37-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From a572436625df3dabf189dc63f1b537d5c50d72fe Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 23 Apr 2023 16:42:55 -0500 Subject: [PATCH 12/21] Add Fedora 38 --- vars/Fedora-38-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-38-default.yml diff --git a/vars/Fedora-38-default.yml b/vars/Fedora-38-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-38-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 62f81512ff3f9f11dd4ee0717268ca9a003f5824 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sat, 16 Mar 2024 20:24:36 -0500 Subject: [PATCH 13/21] Add Fedora 39 --- vars/Fedora-39-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-39-default.yml diff --git a/vars/Fedora-39-default.yml b/vars/Fedora-39-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-39-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 6b0d26252aa24e553154c65c241184839deb394c Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 2 Jun 2024 12:26:49 -0500 Subject: [PATCH 14/21] Fedora 40 support Signed-off-by: Jason Rothstein --- vars/Fedora-40-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-40-default.yml diff --git a/vars/Fedora-40-default.yml b/vars/Fedora-40-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-40-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 67f0221bf210f26de62519f25a8b618f40764b88 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Fri, 27 Dec 2024 15:54:53 -0600 Subject: [PATCH 15/21] Fedora 41 Signed-off-by: Jason Rothstein --- vars/Fedora-41-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-41-default.yml diff --git a/vars/Fedora-41-default.yml b/vars/Fedora-41-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-41-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From eb23188dd3d062c54f6bf0f3d73f6c60b12a6b16 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 27 Apr 2025 12:48:16 -0500 Subject: [PATCH 16/21] Fedora 42 Signed-off-by: Jason Rothstein --- vars/Fedora-42-default.yml | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 vars/Fedora-42-default.yml diff --git a/vars/Fedora-42-default.yml b/vars/Fedora-42-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-42-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 520600d269b2ba1ea9cb80a77850b0cf391dbbad Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Sun, 25 May 2025 20:13:45 -0500 Subject: [PATCH 17/21] Handler improvements Signed-off-by: Jason Rothstein --- handlers/main.yml | 4 +++- tasks/main.yml | 3 +++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/handlers/main.yml b/handlers/main.yml index 6194320..6293062 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -11,7 +11,7 @@ - ensure_selinux is defined ansible.builtin.systemd: daemon_reload: 'yes' -- name: 'ensure_selinux.services' +- name: 'ensure_selinux.service_restart' when: - ansible_system == 'Linux' - ensure_selinux is defined @@ -25,3 +25,5 @@ loop: '{{ ensure_selinux.service_list }}' loop_control: label: '{{ item.name }} will be restarted' +... + diff --git a/tasks/main.yml b/tasks/main.yml index 66fd386..422c2ab 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -67,6 +67,8 @@ notify: - 'ensure_selinux.package_facts' - 'ensure_selinux.service_facts' + - 'ensure_selinux.service_reload' + - 'ensure_selinux.service_restart' - name: 'ensure services' when: - ansible_system == 'Linux' @@ -118,4 +120,5 @@ label: '{{ item.name }} will be {{ item.state }}' - name: 'flush handlers' meta: 'flush_handlers' +... From 9779d1938008552b78230921c674e2b7766966f2 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Thu, 30 Apr 2026 19:45:01 -0500 Subject: [PATCH 18/21] Fedora 43, 44 Signed-off-by: Jason Rothstein --- vars/Fedora-43-default.yml | 9 +++++++++ vars/Fedora-44-default.yml | 9 +++++++++ 2 files changed, 18 insertions(+) create mode 100644 vars/Fedora-43-default.yml create mode 100644 vars/Fedora-44-default.yml diff --git a/vars/Fedora-43-default.yml b/vars/Fedora-43-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-43-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Fedora-44-default.yml b/vars/Fedora-44-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Fedora-44-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 17b4f96aca41566ef212dc8accbabe0af29891c2 Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 5 May 2026 14:10:43 -0500 Subject: [PATCH 19/21] Fix ansible core 2.20 and supported OS list Signed-off-by: Jason Rothstein --- tasks/main.yml | 30 +++++++++---------- ...4-default.yml => AlmaLinux-10-default.yml} | 0 ...35-default.yml => AlmaLinux-8-default.yml} | 0 ...36-default.yml => AlmaLinux-9-default.yml} | 0 ...a-37-default.yml => CentOS-10-default.yml} | 0 ...ra-38-default.yml => CentOS-8-default.yml} | 0 ...ra-39-default.yml => CentOS-9-default.yml} | 0 ...default.yml => OracleLinux-10-default.yml} | 0 ...-default.yml => OracleLinux-8-default.yml} | 0 vars/OracleLinux-9-default.yml | 9 ++++++ vars/Rocky-10-default.yml | 9 ++++++ vars/Rocky-8-default.yml | 9 ++++++ vars/Rocky-9-default.yml | 9 ++++++ 13 files changed, 51 insertions(+), 15 deletions(-) rename vars/{Fedora-34-default.yml => AlmaLinux-10-default.yml} (100%) rename vars/{Fedora-35-default.yml => AlmaLinux-8-default.yml} (100%) rename vars/{Fedora-36-default.yml => AlmaLinux-9-default.yml} (100%) rename vars/{Fedora-37-default.yml => CentOS-10-default.yml} (100%) rename vars/{Fedora-38-default.yml => CentOS-8-default.yml} (100%) rename vars/{Fedora-39-default.yml => CentOS-9-default.yml} (100%) rename vars/{Fedora-40-default.yml => OracleLinux-10-default.yml} (100%) rename vars/{Fedora-41-default.yml => OracleLinux-8-default.yml} (100%) create mode 100644 vars/OracleLinux-9-default.yml create mode 100644 vars/Rocky-10-default.yml create mode 100644 vars/Rocky-8-default.yml create mode 100644 vars/Rocky-9-default.yml diff --git a/tasks/main.yml b/tasks/main.yml index 422c2ab..7f4b7a2 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -2,18 +2,18 @@ # tasks file for ensure_selinux - name: 'include variables' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' include_vars: file: '{{ lookup("first_found", findme ) }}' name: 'ensure_selinux' vars: findme: files: - - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' - - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}-default.yml' - - '{{ ansible_distribution }}-default.yml' - - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-{{ ansible_architecture }}.yml' - - '{{ ansible_os_family }}-{{ ansible_distribution_major_version }}-default.yml' + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' + - '{{ ansible_facts["distribution"] }}-default.yml' + - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_os_family }}-default.yml' - 'default.yml' paths: @@ -21,17 +21,17 @@ errors: 'ignore' - name: 'package discovery' when: - - ansible_system == 'Linux' - - packages is not defined + - ansible_facts["system"] == 'Linux' + - ansible_facts["packages"] is not defined ansible.builtin.package_facts: - name: 'service discovery' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - services is not defined ansible.builtin.service_facts: - name: 'ensure packages' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.package_list is defined - ensure_selinux.package_list is iterable @@ -46,7 +46,7 @@ - 'ensure_selinux.service_facts' - name: 'ensure configurations' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.template_list is defined - ensure_selinux.template_list is iterable @@ -71,7 +71,7 @@ - 'ensure_selinux.service_restart' - name: 'ensure services' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.service_list is defined - ensure_selinux.service_list is iterable @@ -87,7 +87,7 @@ - 'ensure_selinux.service_facts' - name: 'Ensure SELinux is configured' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.selinux_policy is defined - ensure_selinux.selinux_state is defined @@ -97,7 +97,7 @@ register: 'results' - name: 'Reboot if required' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.selinux_policy is defined - ensure_selinux.selinux_state is defined @@ -107,7 +107,7 @@ reboot: - name: 'ensure seboolean' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.seboolean_list is defined - ensure_selinux.seboolean_list is iterable diff --git a/vars/Fedora-34-default.yml b/vars/AlmaLinux-10-default.yml similarity index 100% rename from vars/Fedora-34-default.yml rename to vars/AlmaLinux-10-default.yml diff --git a/vars/Fedora-35-default.yml b/vars/AlmaLinux-8-default.yml similarity index 100% rename from vars/Fedora-35-default.yml rename to vars/AlmaLinux-8-default.yml diff --git a/vars/Fedora-36-default.yml b/vars/AlmaLinux-9-default.yml similarity index 100% rename from vars/Fedora-36-default.yml rename to vars/AlmaLinux-9-default.yml diff --git a/vars/Fedora-37-default.yml b/vars/CentOS-10-default.yml similarity index 100% rename from vars/Fedora-37-default.yml rename to vars/CentOS-10-default.yml diff --git a/vars/Fedora-38-default.yml b/vars/CentOS-8-default.yml similarity index 100% rename from vars/Fedora-38-default.yml rename to vars/CentOS-8-default.yml diff --git a/vars/Fedora-39-default.yml b/vars/CentOS-9-default.yml similarity index 100% rename from vars/Fedora-39-default.yml rename to vars/CentOS-9-default.yml diff --git a/vars/Fedora-40-default.yml b/vars/OracleLinux-10-default.yml similarity index 100% rename from vars/Fedora-40-default.yml rename to vars/OracleLinux-10-default.yml diff --git a/vars/Fedora-41-default.yml b/vars/OracleLinux-8-default.yml similarity index 100% rename from vars/Fedora-41-default.yml rename to vars/OracleLinux-8-default.yml diff --git a/vars/OracleLinux-9-default.yml b/vars/OracleLinux-9-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/OracleLinux-9-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Rocky-10-default.yml b/vars/Rocky-10-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Rocky-10-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Rocky-8-default.yml b/vars/Rocky-8-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Rocky-8-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' diff --git a/vars/Rocky-9-default.yml b/vars/Rocky-9-default.yml new file mode 100644 index 0000000..b16597b --- /dev/null +++ b/vars/Rocky-9-default.yml @@ -0,0 +1,9 @@ +--- +# vars file for ensure_selinux +package_list: + - name: 'python3-libselinux' + state: 'present' + - name: 'python3-libsemanage' + state: 'present' +selinux_policy: 'targeted' +selinux_state: 'enforcing' From 2123bb245abd4a9ca5ff0f95844197a9f0a9904c Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 5 May 2026 15:03:03 -0500 Subject: [PATCH 20/21] More ansible core 2.20 fixes Signed-off-by: Jason Rothstein --- tasks/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tasks/main.yml b/tasks/main.yml index 7f4b7a2..4dcbc00 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -9,10 +9,10 @@ vars: findme: files: - - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_facts["distribution"] }}-default.yml' - - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_architecture }}.yml' + - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_os_family }}-default.yml' - 'default.yml' From 8e3cf35e1ed513d925aabda50c6c8bbe574e2cef Mon Sep 17 00:00:00 2001 From: Jason Rothstein Date: Tue, 5 May 2026 18:17:39 -0500 Subject: [PATCH 21/21] More ansible core 2.20 fixes Signed-off-by: Jason Rothstein --- handlers/main.yml | 6 +++--- tasks/main.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/handlers/main.yml b/handlers/main.yml index 6293062..b3a862e 100644 --- a/handlers/main.yml +++ b/handlers/main.yml @@ -6,14 +6,14 @@ ansible.builtin.service_facts: - name: 'ensure_selinux.service_reload' when: - - ansible_system == 'Linux' - - ansible_service_mgr == 'systemd' + - ansible_facts["system"] == 'Linux' + - ansible_facts["service_mgr"] == 'systemd' - ensure_selinux is defined ansible.builtin.systemd: daemon_reload: 'yes' - name: 'ensure_selinux.service_restart' when: - - ansible_system == 'Linux' + - ansible_facts["system"] == 'Linux' - ensure_selinux is defined - ensure_selinux.service_list is defined - ensure_selinux.service_list is iterable diff --git a/tasks/main.yml b/tasks/main.yml index 4dcbc00..80a7307 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -12,9 +12,9 @@ - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - '{{ ansible_facts["distribution"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - '{{ ansible_facts["distribution"] }}-default.yml' - - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' - - '{{ ansible_os_family }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' - - '{{ ansible_os_family }}-default.yml' + - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-{{ ansible_facts["architecture"] }}.yml' + - '{{ ansible_facts["os_family"] }}-{{ ansible_facts["distribution_major_version"] }}-default.yml' + - '{{ ansible_facts["os_family"] }}-default.yml' - 'default.yml' paths: - '../vars/' @@ -27,7 +27,7 @@ - name: 'service discovery' when: - ansible_facts["system"] == 'Linux' - - services is not defined + - ansible_facts["services"] is not defined ansible.builtin.service_facts: - name: 'ensure packages' when: