setup-lab.yml

---
- hosts: all
  name: Prepares a SELinux workshop
  become: yes
  tasks:

  - name: Update System to latest
    package:
      name: '*'
      state: latest

  - name: Install required packages 
    package:
      name: "{{ packages }}"
      state: present
    vars:
      packages:
        - policycoreutils-python*
        - policycoreutils-devel
        - policycoreutils-newrole
        - setroubleshoot-server
        - setools-console
        - httpd
        - php
        - nfs-utils
        - samba
        - samba-client
        - make
        - gcc-c++
        - libcurl-devel
        - rpm-build
        - firewalld
        - audit
        - tomcat
        - python3-libselinux
        - postfix

  - name: Create the Samba Config
    copy:
      src: files/smb.conf
      dest: /etc/samba/smb.conf

  - name: Create the NFS export config
    copy:
      src: files/exports
      dest: /etc/exports

  - name: Create an SMB Share
    file:
      path: /share
      state: directory

  - name: Create an NFS-Share
    file:
      path: /nfsshare
      state: directory

  - name: Add the user tester with password tester
    user:
      name: tester
      shell: /bin/bash
      password: "$6$BqElT6SDhbfBOwge$6pmqUG2VPObkKu4OqTZfjSAvU9mvd.uvnZO26K5HrKMnF/Q7sTUJ6PvaEFDRWsjeoBoEyjCCt349/b4VL9G9x/"
  
  - name: Shoot your self in the foot set mode 666 for /etc/shadow
    file:
      path: /etc/shadow
      mode: 0666

  - name: Ensure SELinux is in enforcing mode
    selinux:
      policy: targeted
      state: enforcing

  - name: Add a SMB user "tester" with the password "tester"
    shell: printf "tester\ntester\n" | smbpasswd -a -s tester

  - name: Ensure Apache is enabled and stopped (needs to be fixed by workshop participants first)
    service: 
      name: httpd
      state: stopped
      enabled: yes

  - name: Open firewalld on port 3131/tcp
    firewalld:
      port: 3131/tcp
      state: enabled
      permanent: true

  - name: Open firewalld for our services
    firewalld:
      service: "{{ item }}"
      state: enabled
      permanent: true
    with_items:
      - nfs
      - samba
      - http

  - name: Ensure the SELinux Tomcat test app is on the system
    copy:
      src: files/sample.war
      dest: /var/lib/tomcat/webapps/sample.war
      mode: 0644

  - name: Create test_www dir with webpages
    file:
      path: /var/test_www/html
      state: directory
      owner: apache
      group: apache
      mode: 0755

  - name: Copy the index.html
    copy: 
      src: files/index.html
      dest: /var/test_www/html/index.html

  - name: Copy the mail.php PHP script
    copy: 
      src: files/mail.php
      dest: /var/test_www/html/mail.php

  - name: copy the CGI script
    copy:
      src: files/shadow.sh
      dest: /var/www/cgi-bin/shadow.sh
      mode: 0755

  - name: Use custom port 3131 for Apache binding
    lineinfile:
      path: /etc/httpd/conf/httpd.conf
      regexp: '^Listen '
      line: 'Listen 3131'

  - name: Use custom DocumentRoot for Apache
    lineinfile:
      path: /etc/httpd/conf/httpd.conf
      regexp: 'DocumentRoot "/var/www/html"'
      line: 'DocumentRoot "/var/test_www/html"'

  - name: Use custom DocumentRoot for Apache
    lineinfile:
      path: /etc/httpd/conf/httpd.conf
      regexp: '<Directory "/var/www/html">'
      line: '<Directory "/var/test_www/html">'

  - name: Create dir with working files
    file:
      path: /root/selinuxlab
      state: directory
      mode: 0755

  - name: Ensure SELinux test app source is on the system
    copy:
      src: files/testapp.c
      dest: /root/selinuxlab
      mode: 0755

  - name: Ensure Makefile for the test app is copied to the system
    copy:
      src: files/Makefile
      dest: /root/selinuxlab
      mode: 0755

  - name: Ensure SELinux test app service file is on the system
    copy:
      src: files/testapp.service
      dest: /root/selinuxlab/testapp.service
      mode: 0644

  - name: Compile the testapp
    shell:
      cmd: "make -f /root/selinuxlab/Makefile"
      chdir: /root/selinuxlab

  - name: Install the testapp
    shell:
      cmd: "make install -f /root/selinuxlab/Makefile"
      chdir: /root/selinuxlab

  - name: Enable and start required services
    service:
      name: "{{ item }}"
      state: started
      enabled: yes
    with_items:
        - postfix
        - auditd
        - smb
        - nfs-server
        - firewalld

  - name: Reboot host
    shell: sleep 10 && /sbin/shutdown -r now
    async: 300
    poll: 0
    become: true