initial commit

roles/apparmor_config/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+apparmor_config_complain_profiles: []
+# apparmor_config_complain_profiles:
+#   - /usr/sbin/nginx

roles/apparmor_config/tasks/main.yml

@@ -0,0 +1,42 @@
+---
+- name: Install AppArmor packages
+  ansible.builtin.package:
+    name:
+      - apparmor
+      - apparmor-utils
+      - apparmor-profiles
+    state: present
+  tags: [apparmor_config]
+
+- name: Enable and start AppArmor
+  ansible.builtin.systemd:
+    name: apparmor
+    enabled: true
+    state: started
+  tags: [apparmor_config]
+
+- name: Set enforce mode for all loaded profiles
+  ansible.builtin.shell: aa-enforce /etc/apparmor.d/*
+  register: apparmor_config_enforce_result
+  changed_when: "'Setting' in apparmor_config_enforce_result.stdout"
+  failed_when: false
+  tags: [apparmor_config]
+
+- name: Set application-specific profiles to complain mode (exceptions)
+  ansible.builtin.command: "aa-complain {{ item }}"
+  loop: "{{ apparmor_config_complain_profiles }}"
+  when: apparmor_config_complain_profiles | length > 0
+  changed_when: true
+  tags: [apparmor_config]
+
+- name: Query AppArmor status
+  ansible.builtin.command: aa-status --verbose
+  register: apparmor_config_status
+  changed_when: false
+  failed_when: false
+  tags: [apparmor_config]
+
+- name: Report AppArmor status
+  ansible.builtin.debug:
+    msg: "AppArmor status on {{ inventory_hostname }}: {{ apparmor_config_status.stdout_lines[0] | default('unavailable') }}"
+  tags: [apparmor_config]