You've already forked ansible-linux-infra
43 lines
1.2 KiB
YAML
43 lines
1.2 KiB
YAML
---
|
|
- name: Install AppArmor packages
|
|
ansible.builtin.package:
|
|
name:
|
|
- apparmor
|
|
- apparmor-utils
|
|
- apparmor-profiles
|
|
state: present
|
|
tags: [apparmor_config]
|
|
|
|
- name: Enable and start AppArmor
|
|
ansible.builtin.systemd:
|
|
name: apparmor
|
|
enabled: true
|
|
state: started
|
|
tags: [apparmor_config]
|
|
|
|
- name: Set enforce mode for all loaded profiles
|
|
ansible.builtin.shell: aa-enforce /etc/apparmor.d/*
|
|
register: apparmor_config_enforce_result
|
|
changed_when: "'Setting' in apparmor_config_enforce_result.stdout"
|
|
failed_when: false
|
|
tags: [apparmor_config]
|
|
|
|
- name: Set application-specific profiles to complain mode (exceptions)
|
|
ansible.builtin.command: "aa-complain {{ item }}"
|
|
loop: "{{ apparmor_config_complain_profiles }}"
|
|
when: apparmor_config_complain_profiles | length > 0
|
|
changed_when: true
|
|
tags: [apparmor_config]
|
|
|
|
- name: Query AppArmor status
|
|
ansible.builtin.command: aa-status --verbose
|
|
register: apparmor_config_status
|
|
changed_when: false
|
|
failed_when: false
|
|
tags: [apparmor_config]
|
|
|
|
- name: Report AppArmor status
|
|
ansible.builtin.debug:
|
|
msg: "AppArmor status on {{ inventory_hostname }}: {{ apparmor_config_status.stdout_lines[0] | default('unavailable') }}"
|
|
tags: [apparmor_config]
|