Enforce SELinux on EL and Enable Apparmor in Ubuntu/Debian/SUSE

weizhouapache · weizhouapache · commit 4b19093d0f51 · 2026-06-16T14:11:28.000+02:00
diff --git a/Ansible/roles/cloudstack-manager/tasks/centos.yml b/Ansible/roles/cloudstack-manager/tasks/centos.yml
@@ -12,12 +12,7 @@
 - name: Clear all yum cache
   command: yum clean all
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
+- include: ../../../tasks/configure_selinux.yml
 
 - name: Ensure CA Certs are latest
   yum: name=ca-certificates state=latest enablerepo=base
diff --git a/Ansible/roles/cloudstack-manager/tasks/centos8.yml b/Ansible/roles/cloudstack-manager/tasks/centos8.yml
@@ -19,12 +19,7 @@
   file: path=/etc/hostname state=absent
   when: ansible_distribution_major_version == "7"
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
+- include: ../../../tasks/configure_selinux.yml
 
 - name: get name of eth0 connection
   shell: nmcli device show eth0 | grep 'GENERAL.CONNECTION' | awk -F ':' '{print $2}' | sed 's/^ *//'
diff --git a/Ansible/roles/cloudstack-manager/tasks/debian.yml b/Ansible/roles/cloudstack-manager/tasks/debian.yml
@@ -123,6 +123,8 @@
 - name: Ensure vhd-util is present
   get_url: url="{{ vhdutil_url }}" dest=/usr/share/cloudstack-common/scripts/vm/hypervisor/xenserver/vhd-util mode=0755
 
+- include: ../../../tasks/configure_apparmor.yml
+
 - include: ./setupdb.yml
 
 - name: Ensure CloudStack packages are installed (now that mgmt server "db.properties" and "key" files are present)
diff --git a/Ansible/roles/cloudstack-manager/tasks/el9.yml b/Ansible/roles/cloudstack-manager/tasks/el9.yml
@@ -29,12 +29,7 @@
     state: present
   tags: services
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
+- include: ../../../tasks/configure_selinux.yml
 
 - name: get name of eth0 connection
   shell: nmcli device show eth0 | grep 'GENERAL.CONNECTION' | awk -F ':' '{print $2}' | sed 's/^ *//'
diff --git a/Ansible/roles/cloudstack-manager/tasks/suse.yml b/Ansible/roles/cloudstack-manager/tasks/suse.yml
@@ -21,14 +21,7 @@
   shell: "zypper install -y python3-selinux"
   ignore_errors: yes
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-  ignore_errors: yes
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
-  ignore_errors: yes
+- include: ../../../tasks/configure_apparmor.yml
 
 - name: Allow connections on management server required ports with firewall
   shell: "firewall-cmd --zone=public --add-port={{ item }}/tcp --permanent"
diff --git a/Ansible/roles/cloudstack-manager/tasks/ubuntu.yml b/Ansible/roles/cloudstack-manager/tasks/ubuntu.yml
@@ -119,6 +119,8 @@
 - name: Ensure vhd-util is present
   get_url: url="{{ vhdutil_url }}" dest=/usr/share/cloudstack-common/scripts/vm/hypervisor/xenserver/vhd-util mode=0755
 
+- include: ../../../tasks/configure_apparmor.yml
+
 - include: ./setupdb.yml
 
 - name: Ensure CloudStack packages are installed (now that mgmt server "db.properties" and "key" files are present)
diff --git a/Ansible/roles/kvm/tasks/centos.yml b/Ansible/roles/kvm/tasks/centos.yml
@@ -15,14 +15,7 @@
   tags:
     - kvm
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-  tags:
-    - kvm
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
+- include: ../../../tasks/configure_selinux.yml
   tags:
     - kvm
 
diff --git a/Ansible/roles/kvm/tasks/centos8.yml b/Ansible/roles/kvm/tasks/centos8.yml
@@ -16,14 +16,7 @@
   tags:
     - kvm
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-  tags:
-    - kvm
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
+- include: ../../../tasks/configure_selinux.yml
   tags:
     - kvm
 
diff --git a/Ansible/roles/kvm/tasks/debian.yml b/Ansible/roles/kvm/tasks/debian.yml
@@ -287,19 +287,7 @@
 - name: update /etc/libvirt/qemu.conf
   lineinfile: dest=/etc/libvirt/qemu.conf regexp='#vnc_listen = "0.0.0.0"' line='vnc_listen = "0.0.0.0"'
 
-- name: Symlink to disable
-  file: src=/etc/apparmor.d/usr.sbin.libvirtd dest=/etc/apparmor.d/disable/usr.sbin.libvirtd state=link
-
-- name: Symlink to disable
-  file: src=/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper dest=/etc/apparmor.d/disable/usr.lib.libvirt.virt-aa-helper state=link
-
-- name: Apparmor parser libvirt
-  shell: apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd
-  ignore_errors: yes
-
-- name: Apparmor parser libvirt helper
-  shell: apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper
-  ignore_errors: yes
+- include: ../../../tasks/configure_apparmor.yml
 
 - name: Delete DHCP leases file - bionic onwards
   file: path={{ item }} state=absent
diff --git a/Ansible/roles/kvm/tasks/el9.yml b/Ansible/roles/kvm/tasks/el9.yml
@@ -30,14 +30,7 @@
   tags:
     - kvm
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-  tags:
-    - kvm
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
+- include: ../../../tasks/configure_selinux.yml
   tags:
     - kvm
 
diff --git a/Ansible/roles/kvm/tasks/suse.yml b/Ansible/roles/kvm/tasks/suse.yml
@@ -30,18 +30,9 @@
   shell: "zypper install -y net-tools-deprecated"
   ignore_errors: yes # This package is deprecated. ignoring errors for older distros
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
+- include: ../../../tasks/configure_apparmor.yml
   tags:
     - kvm
-  ignore_errors: yes
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
-  tags:
-    - kvm
-  ignore_errors: yes
 
 - include: ./kvm_networking_bridge8.yml
   when: (not use_phys_hosts) and (kvm_network_mode == "bridge")
diff --git a/Ansible/roles/kvm/tasks/ubuntu.yml b/Ansible/roles/kvm/tasks/ubuntu.yml
@@ -361,19 +361,7 @@
 - name: update /etc/libvirt/qemu.conf
   lineinfile: dest=/etc/libvirt/qemu.conf regexp='#vnc_listen = "0.0.0.0"' line='vnc_listen = "0.0.0.0"'
 
-- name: Symlink to disable
-  file: src=/etc/apparmor.d/usr.sbin.libvirtd dest=/etc/apparmor.d/disable/usr.sbin.libvirtd state=link
-
-- name: Symlink to disable
-  file: src=/etc/apparmor.d/usr.lib.libvirt.virt-aa-helper dest=/etc/apparmor.d/disable/usr.lib.libvirt.virt-aa-helper state=link
-
-- name: Apparmor parser libvirt
-  shell: apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd
-  ignore_errors: yes
-
-- name: Apparmor parser libvirt helper
-  shell: apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper
-  ignore_errors: yes
+- include: ../../../tasks/configure_apparmor.yml
 
 - name: Delete DHCP leases file - bionic onwards
   file: path={{ item }} state=absent
diff --git a/Ansible/roles/marvin/tasks/main.yml b/Ansible/roles/marvin/tasks/main.yml
@@ -28,13 +28,7 @@
 - name: Ensure sshpass is installed
   dnf: name=sshpass state=present
 
-- name: Put SELinux in permissive mode, logging actions that would be blocked.
-  selinux:
-    policy: targeted
-    state: permissive
-
-- name: set live selinux
-  command: setenforce permissive
+- include: ../../../tasks/configure_selinux.yml
 
 - name: sync time with mgmt server
   shell: date --set=`sshpass -p 'P@ssword123' ssh -o StrictHostKeyChecking=no root@{{ hostvars[groups['primary_cs_manager'][0]]['ansible_ssh_host'] }} 'date --iso-8601=seconds'`
diff --git a/Ansible/roles/mysql/tasks/centos.yml b/Ansible/roles/mysql/tasks/centos.yml
@@ -30,12 +30,10 @@
   yum: name=MySQL-python state=present
   tags: services
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
+- include: ../../../tasks/configure_selinux.yml
+  tags:
+    - mysql
+    - mysqlconf
 
 - name: Ensure mysql server is installed (centos/rhel6)
   yum: name=mysql-server state=present
diff --git a/Ansible/roles/mysql/tasks/centos8.yml b/Ansible/roles/mysql/tasks/centos8.yml
@@ -37,17 +37,7 @@
     - mysql
     - mysqlconf
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-  tags:
-    - mysql
-    - mysqlconf
-
-- name: Ensure selinux is set permanently
-  selinux:
-    policy: targeted
-    state: permissive
+- include: ../../../tasks/configure_selinux.yml
   tags:
     - mysql
     - mysqlconf
diff --git a/Ansible/roles/mysql/tasks/el9.yml b/Ansible/roles/mysql/tasks/el9.yml
@@ -37,17 +37,7 @@
     - mysql
     - mysqlconf
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
-  tags:
-    - mysql
-    - mysqlconf
-
-- name: Ensure selinux is set permanently
-  selinux:
-    policy: targeted
-    state: permissive
+- include: ../../../tasks/configure_selinux.yml
   tags:
     - mysql
     - mysqlconf
diff --git a/Ansible/roles/mysql/tasks/suse.yml b/Ansible/roles/mysql/tasks/suse.yml
@@ -46,19 +46,10 @@
     - mysqlconf
   ignore_errors: yes
 
-- name: Set selinux to permissive
-  command: setenforce permissive
-  changed_when: false
+- include: ../../../tasks/configure_apparmor.yml
   tags:
     - mysql
     - mysqlconf
-  ignore_errors: yes
-
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=permissive
-  tags:
-    - kvm
-  ignore_errors: yes
 
 - name: Check if mysql server is installed
   shell: rpm -q mysql-server
diff --git a/Ansible/tasks/configure_apparmor.yml b/Ansible/tasks/configure_apparmor.yml
@@ -0,0 +1,14 @@
+---
+- name: Install apparmor-utils
+  apt:
+    pkg: apparmor-utils
+    state: latest
+    update_cache: yes
+  ignore_errors: true
+
+- name: Enable Apparmor enforce mode
+  shell: aa-enforce /etc/apparmor.d/*
+
+- name: Check Apparmor status 
+  shell: aa-status
+  ignore_errors: true
diff --git a/Ansible/tasks/configure_selinux.yml b/Ansible/tasks/configure_selinux.yml
@@ -0,0 +1,18 @@
+---
+
+- name: Get current SELinux mode
+  shell: getenforce || true
+  register: selinux_mode
+
+- name: Set selinux to enforcing
+  command: setenforce enforcing
+  changed_when: false
+  when: selinux_mode.stdout != "Enforcing"
+
+- name: Ensure selinux is set permanently
+  selinux: policy=targeted state=enforcing
+  when: selinux_mode.stdout != "Enforcing"
+
+- name: Check SELinux status
+  shell: sestatus
+  ignore_errors: true
