Support configuring SELinux and default to enforcing

[jaredledvina]

Closes #154

I think this might do the right thing, will checkout the build though. I chose to default to enforcing as I don't want the defaults here to actually walk back the configuration that RHEL and friends ship with.

Signed-off-by: Jared Ledvina [email protected]

[rndmh3ro]

Hey @jaredledvina,

this looks good and straight forward! I'd like to do some tests on all supported operating systems before merging, to see what happens on them.

[jaredledvina]

Sweet, thanks @rndmh3ro!

I don't have a system currently configured w/ SELinux working but, if you'd like, I can try to make a temp DigitalOcean VM or something to make sure this works. My only concern would be that I don't know if we can ever test SELinux things like this via TravisCI unless they have a CentOS/Fedora base OS setup I'm unaware of.

[rndmh3ro]

I don't have a system currently configured w/ SELinux working but, if you'd like, I can try to make a temp DigitalOcean VM or something to make sure this works

I'll just test it with the vagrant-vms - that should be enough. Of course you can test the changes, too, if you want!

My only concern would be that I don't know if we can ever test SELinux things like this via TravisCI unless they have a CentOS/Fedora base OS setup I'm unaware of.

Travis does not support this. Selinux testing is kind of a pain, however doing it locally and manually with vagrant usally works.

[rndmh3ro]

I just tested it on CentOS 8 ans Ansible 2.8.5 and wondered why the import-task was being skipped. For me importing only worked like this:

- import_tasks: selinux.yml
  tags: selinux
  when:
    - ansible_facts.selinux is defined
    - ansible_facts.selinux

Can you recheck on your side?

[jaredledvina]

Sorry about that!

Okay so, reading through https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/facts/system/selinux.py, it looks like I can do a when on the selinux.status fact being enabled such that we only include this play if the host 1) has the selinux python lib & 2) has actually enabled SELinux on the host.

[rndmh3ro]

Finally came around to testing it and works great. Thank you @jaredledvina!