37 lines
1.5 KiB
Bash
37 lines
1.5 KiB
Bash
# Time and SELinux can't be managed in a container node (they belong to
|
|
# the VM's kernel), so this lab manages the control node itself.
|
|
command -v getenforce >/dev/null && [ "$(getenforce)" != Disabled ] ||
|
|
refuse "SELinux is disabled on this VM; turning it on needs a relabel and a reboot"
|
|
[ -f /etc/chrony.conf ] || refuse "/etc/chrony.conf is missing; install chrony first"
|
|
|
|
# Everything installed from here on (by setup or by the roles) goes again
|
|
# at reset.
|
|
rpm -qa --qf '%{NAME}\n' | sort -u >"$LAB_STATE/rpms"
|
|
for p in ansible-core rhel-system-roles; do pkg_installed $p || pkg_install $p; done
|
|
|
|
# What the tasks change, as it was.
|
|
cp -a /etc/chrony.conf "$LAB_STATE/chrony.conf"
|
|
cp -a /etc/selinux/config "$LAB_STATE/selinux-config"
|
|
state_set enforce "$(getenforce)"
|
|
state_set boolean "$(getsebool httpd_can_network_connect | awk '{print $3}')"
|
|
|
|
# The starting point: SELinux permissive, the boolean off.
|
|
sed -i 's/^SELINUX=.*/SELINUX=permissive/' /etc/selinux/config
|
|
setenforce 0
|
|
setsebool -P httpd_can_network_connect off
|
|
|
|
# greg's project; he may use sudo, for become on localhost.
|
|
user_add greg
|
|
printf 'greg ALL=(ALL) NOPASSWD: ALL\n' >/etc/sudoers.d/le-lab-greg
|
|
chmod 440 /etc/sudoers.d/le-lab-greg
|
|
install -d -m 755 -o greg -g greg /home/greg/ansible
|
|
cat >/home/greg/ansible/ansible.cfg <<'X'
|
|
[defaults]
|
|
inventory = inventory
|
|
|
|
[privilege_escalation]
|
|
become = true
|
|
X
|
|
printf '[webservers]\nlocalhost ansible_connection=local\n' >/home/greg/ansible/inventory
|
|
chown greg: /home/greg/ansible/ansible.cfg /home/greg/ansible/inventory
|