-
Notifications
You must be signed in to change notification settings - Fork 0
/
main.yml
61 lines (48 loc) · 1.89 KB
/
main.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# so, first there is the use of tcp ports
# in the terminal you can give it access with "setsebool -P nis_enabled 1"
# THIS is done below here
######## DEGUG WITH ##########
## sealert -l "*" | less #####
##############################
# equivalent of
# 1) semanage fcontext -a -t var_t "/srv/galaxy(/.*)?"
# 2) restorecon -Rv /srv/galaxy
- name: Set selinux-fcontext for /srv/galaxy
sefcontext:
target: '/srv/galaxy(/.*)?'
setype: var_t
state: present
- name: Set selinux-fcontext for /storage/galaxy
sefcontext:
target: '/storage(/galaxy/.*)?'
setype: var_t
seuser: system_u
state: present
# Run in case the above commands fail
- name: Run restorecon -Rv just in case if sefcontext fails
command: "{{ item }}"
with_items:
- "restorecon -Rv /storage/galaxy/"
- "restorecon -Rv /srv/galaxy/"
# in ansible that will be something like this, then you will kind off have a sort of documentation on what is done as well, so I recomend putting it ansible (you can do it in the terminal as well).
- name: Set network persmissions for galaxy to use tcp-ports
seboolean:
name: nis_enabled
state: yes
persistent: yes
- name: Set mmap-permission for galaxy on files
seboolean:
name: domain_can_mmap_files
state: yes
persistent: yes
# Then we need to give init_t access to var_t and the postgres-socket, you can do these commands directly in the terminal as well
- name: "Create selinux dir"
file: dest=/tmp/selinux state=directory
- name: "Copy selinux files"
copy: src="{{ role_path }}/files/galaxy_selinux.te" dest=/tmp/selinux
- name: "Check modules"
shell: "checkmodule -M -m -o /tmp/selinux/galaxy_selinux.mod /tmp/selinux/galaxy_selinux.te"
- name: "Package modules"
shell: "semodule_package -o /tmp/selinux/galaxy_selinux.pp -m /tmp/selinux/galaxy_selinux.mod"
- name: "Install modules"
shell: "semodule -i /tmp/selinux/galaxy_selinux.pp"