site.yml

---

- name: Configure SELinux Sandbox
  hosts: all
  become: yes

  vars:
    user: poc_testuser

  handlers:
    - name: reload httpd
      service: name=httpd state=reloaded

  tasks:
    - name: Set SELinux to Enforcing
      selinux: policy=targeted state=enforcing
      register: selinux_state

    - name: Get SELinux label status
      shell: ls -Z | grep redhat-release
      args:
        chdir: /etc/
      register: selinux_label_state
      ignore_errors: true
      changed_when: false

    - name: Enable relabel of filesystem during reboot
      file:
        path: /.autorelabel
        state: touch
      when: "'system_u:object_r:etc_t:s0' not in selinux_label_state.stdout"

    - name: Reboot to set SELinux state
#      shell: /sbin/shutdown -r now
      shell: nohup bash -c sleep 2s && reboot &
      async: 0
      poll: 0
      ignore_errors: true
      when: selinux_state|changed
      register: reboot_necessary

    - name: Wait for reboot and relabeling to finish
      wait_for:
        host: "{{ inventory_hostname }}"
        port: 22
        delay: 10
        timeout: 300
        state: started
      when: reboot_necessary|changed

    - name: Install EPEL
      yum:
        name: epel-release
        state: present
      register: epelstate

    - name: Install requirements
      package:
        name: "{{ item }}"
        state: present
        update_cache: "{{ epelstate | changed }}"
      with_items:
        - httpd
        - setroubleshoot-server
        - setools-console
        - mcstrans
        - policycoreutils-python
        - policycoreutils-restorecond
        - selinux-policy-devel
        - htop
        - python34
        - zsh
        - tmux
        - rsync
        - nc
        - ruby
        - git
        - "@Development Tools"
        - libcgroup-tools
        - http://pkgs.repoforge.org/stress/stress-1.0.2-1.el7.rf.x86_64.rpm

    - name: Start services
      service:
        name: "{{ item }}"
        enabled: yes
        state: started
      with_items:
        - httpd
        - restorecond

    - name: Open firewall for httpd
      firewalld:
        service: http
        permanent: true
        state: enabled

    - name: Create group
      group:
        name: "{{ item }}"
        state: present
      with_items:
        - "{{ user }}"

    - name: Create user
      user:
        name: "{{ user }}"
        state: present
        group: "{{ item }}"
      with_items:
        - "{{ user }}"

    - name: Get UID
      stat:
        path: /home/{{ user }}
      register: homedir
      ignore_errors: true
      changed_when: false

    - name: Enable User Slice for {{ homedir.stat.uid }}/{{ user }}
      command: systemctl start user-{{ homedir.stat.uid }}.slice
      register: slice_state

    - name: Create Control Group
      command: systemctl set-property user-{{ homedir.stat.uid }}.slice CPUShares=512 MemoryLimit=1024M
      register: cgcreate_state

    - name: Copy SELinux shelluser policy template
      template:
        src: shelluser.te.j2
        dest: /tmp/uberspace_{{ user }}.te

    - name: Compile SELinux policy
      shell: make -f /usr/share/selinux/devel/Makefile uberspace_{{ user }}.pp
      args:
        chdir: /tmp/
      register: shelluser_policy

    - name: Import compiled SELinux policy
      shell: semodule -i uberspace_{{ user }}.pp
      args:
        chdir: /tmp/
      register: semodule_state

    - name: Create SELinux user
      shell: semanage user -a -R "uberspace_{{ user }}_r" "uberspace_{{ user }}_u"
      register: semanage_state

    - name: Add targeted user context
      template:
        src: shelluser_u.j2
        dest: /etc/selinux/targeted/contexts/users/uberspace_{{ user }}_u

    - name: Add UNIX user to SELinux context
      shell: usermod -Z "uberspace_{{ user }}_u" "{{ user }}"
      register: userstate

    - name: Create user httpdocs
      file:
        path: /var/www/virtual/{{ user }}
        state: directory
        seuser: "uberspace_{{ user }}_u"
        owner: "{{ user }}"
        group: "{{ user }}"

    - name: Confine user to home directory
      file:
        path: "{{ item }}"
        state: directory
        seuser: "uberspace_{{ user }}_u"
      with_items:
        - /home/{{ user }}
        - /var/www/virtual/{{ user }}

    - name: Create SSH configuration directory
      file:
        path: /home/{{ user }}/.ssh
        state: directory

    - name: Enable SSH access for {{ user }} using vagrant public key
      command: cp /home/vagrant/.ssh/authorized_keys /home/{{ user }}/.ssh/authorized_keys

    - name: Fix directory permissions
      file:
        path: /home/{{ user }}/.ssh
        owner: "{{ user }}"
        group: "{{ user }}"
        recurse: true

    - name: Enable VirtualHost configuration for {{ user }}
      template:
        src: virtualhost.conf.j2
        dest: /etc/httpd/conf.d/
      notify: reload httpd

#    - name: Enable booleans for {{ user }}
#      seeboolean: "{{ item }}"
#        persistent: yes
#        state: yes
#      with_items:
#        - allow_user_mysql_connect
#        - allow_user_postgresql_connect
#        - selinuxuser_ping