installed firewalld and selinux permissions

roles/stoat/tasks/harden.yml

@@ -1,7 +1,14 @@
 ---
 # ------------------------------------------------------------
 # Firewall (firewalld) - default deny, allow only what is needed
+# Native/minimal Fedora installs may not ship firewalld, so
+# install it explicitly before starting it.
 # ------------------------------------------------------------
+- name: Install firewalld
+  ansible.builtin.dnf:
+    name: firewalld
+    state: present
+
 - name: Start and enable firewalld
   ansible.builtin.systemd:
     name: firewalld

roles/stoat/tasks/podman.yml

@@ -30,4 +30,34 @@
 # on boot without an interactive login.
 - name: Enable lingering for the service user
   ansible.builtin.command: "loginctl enable-linger {{ stoat_service_user }}"
+  changed_when: false
+
+# ------------------------------------------------------------
+# SELinux - keep enforcing, ensure the container policy and
+# diagnostic tools are present for resolving any denials.
+# ------------------------------------------------------------
+- name: Install SELinux container policy and diagnostics tools
+  ansible.builtin.dnf:
+    name:
+      - container-selinux
+      - policycoreutils-python-utils
+      - setools-console
+    state: present
+
+- name: Check current SELinux mode
+  ansible.builtin.command: getenforce
+  register: selinux_current_mode
+  changed_when: false
+
+- name: Configure SELinux mode in /etc/selinux/config
+  ansible.builtin.lineinfile:
+    path: /etc/selinux/config
+    regexp: '^SELINUX='
+    line: 'SELINUX={{ selinux_mode }}'
+
+- name: Apply SELinux mode now
+  ansible.builtin.command: "setenforce {{ selinux_mode }}"
+  when:
+    - selinux_mode | lower == "enforcing"
+    - selinux_current_mode.stdout | lower != "enforcing"
   changed_when: false