-
Notifications
You must be signed in to change notification settings - Fork 344
/
setup-selinux.yml
68 lines (59 loc) · 2.1 KB
/
setup-selinux.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
---
- name: (RHEL) Install dependencies
ansible.builtin.yum:
name:
- libselinux-utils
- policycoreutils
- selinux-policy-targeted
when: ansible_facts['os_family'] == "RedHat"
- name: Set SELinux mode to permissive
ansible.posix.selinux:
state: permissive
policy: targeted
- name: Allow SELinux HTTP network connections
ansible.posix.seboolean:
name: "{{ item }}"
state: true
persistent: true
loop:
- httpd_can_network_connect
- httpd_can_network_relay
- name: Allow SELinux TCP connections on specific ports
community.general.seport:
ports: "{{ nginx_selinux_tcp_ports }}"
proto: tcp
setype: http_port_t
state: present
when: nginx_selinux_tcp_ports is defined
- name: Allow SELinux UDP connections on specific ports
community.general.seport:
ports: "{{ nginx_selinux_udp_ports }}"
proto: udp
setype: http_port_t
state: present
when: nginx_selinux_udp_ports is defined
- name: Create SELinux NGINX Plus module
ansible.builtin.template:
src: "{{ role_path }}/templates/selinux/nginx-plus-module.te.j2"
dest: "{{ nginx_selinux_tempdir }}/nginx-plus-module.te"
mode: "0644"
register: nginx_selinux_module
- name: Check SELinux NGINX Plus module
ansible.builtin.command: checkmodule -M -m -o {{ nginx_selinux_tempdir }}/nginx-plus-module.mod {{ nginx_selinux_tempdir }}/nginx-plus-module.te
args:
creates: "{{ nginx_selinux_tempdir }}/nginx-plus-module.mod"
changed_when: false
- name: Compile SELinux NGINX Plus module
ansible.builtin.command: semodule_package -o {{ nginx_selinux_tempdir }}/nginx-plus-module.pp -m {{ nginx_selinux_tempdir }}/nginx-plus-module.mod
args:
creates: "{{ nginx_selinux_tempdir }}/nginx-plus-module.pp"
changed_when: false
- name: Import SELinux NGINX Plus module
ansible.builtin.command: semodule -i {{ nginx_selinux_tempdir }}/nginx-plus-module.pp # noqa no-handler
changed_when: false
when: nginx_selinux_module['changed'] | bool
- name: Set SELinux mode to enforcing
ansible.posix.selinux:
state: enforcing
policy: targeted
when: nginx_selinux_enforcing | bool