Update as suggested by Copilot

Author: weizhouapache

Ansible/tasks/configure_apparmor.yml

@@ -1,14 +1,22 @@
 ---
-- name: Install apparmor-utils
+- name: Install apparmor-utils (Debian/Ubuntu)
   apt:
     pkg: apparmor-utils
-    state: latest
+    state: present
     update_cache: yes
-  ignore_errors: true
+  when: ansible_distribution in ['Ubuntu', 'Debian']
+
+- name: Install apparmor-utils (SUSE)
+  package:
+    name: apparmor-utils
+    state: present
+  when: ansible_distribution == 'SUSE'
 
 - name: Enable Apparmor enforce mode
   shell: aa-enforce /etc/apparmor.d/*
+  changed_when: false
 
-- name: Check Apparmor status 
-  shell: aa-status
-  ignore_errors: true
+- name: Check Apparmor status
+  command: aa-status
+  failed_when: false
+  changed_when: false

Ansible/tasks/configure_selinux.yml

@@ -1,18 +1,27 @@
 ---
 
 - name: Get current SELinux mode
-  shell: getenforce || true
+  command: getenforce
   register: selinux_mode
+  failed_when: false
+  changed_when: false
 
-- name: Set selinux to enforcing
-  command: setenforce enforcing
+- name: Set SELinux to enforcing
+  command: setenforce Enforcing
   changed_when: false
-  when: selinux_mode.stdout != "Enforcing"
+  when:
+    - selinux_mode.rc == 0
+    - selinux_mode.stdout not in ['Enforcing', 'Disabled']
 
-- name: Ensure selinux is set permanently
-  selinux: policy=targeted state=enforcing
-  when: selinux_mode.stdout != "Enforcing"
+- name: Ensure SELinux is set permanently
+  selinux:
+    policy: targeted
+    state: enforcing
+  when:
+    - selinux_mode.rc == 0
+    - selinux_mode.stdout != 'Disabled'
 
 - name: Check SELinux status
-  shell: sestatus
-  ignore_errors: true
+  command: sestatus
+  failed_when: false
+  changed_when: false