22 lines
734 B
YAML
22 lines
734 B
YAML
---
|
|
# SELinux hardening: enforcing mode plus correct labels for container data.
|
|
|
|
- name: Enforce SELinux (targeted policy)
|
|
ansible.builtin.selinux:
|
|
policy: targeted
|
|
state: enforcing
|
|
|
|
- name: Ensure semanage is available
|
|
ansible.builtin.dnf:
|
|
name: policycoreutils-python-utils
|
|
state: present
|
|
|
|
- name: Add SELinux file context for the Minecraft data directory
|
|
ansible.builtin.command:
|
|
cmd: semanage fcontext -a -t container_file_t "{{ minecraft_data_dir }}(/.*)?"
|
|
register: selinux_fcontext
|
|
changed_when: selinux_fcontext.rc == 0
|
|
failed_when:
|
|
- selinux_fcontext.rc != 0
|
|
- "'already defined' not in (selinux_fcontext.stdout + selinux_fcontext.stderr)"
|
|
when: selinux_set_minecraft_fcontext | bool |