Add selinux-check

Author: Sebastian Gumprich

roles/ansible-ssh-hardening/tasks/main.yml

@@ -2,15 +2,22 @@
 - name: add the OS specific variables
   include_vars: "{{ ansible_os_family }}.yml"
 
+- name: check is selinux is installed
+  command: getenforce
+  register: selinux_installed
+  ignore_errors: true
+  changed_when: false
+
 - name: test to see if selinux is running
   command: getenforce
   register: sestatus
   changed_when: false
+  when: selinux_installed.rc == 0
 
 - name: check the ssh_password policy state
   shell: semodule -l | grep "ssh_password" | awk '{print $3}' 
   register: selinux_policy_state
-  when: sestatus.stdout == 'Enforcing'
+  when: selinux_installed.rc == 0
   changed_when: false
 
 - name: create sshd_config and set permissions to root/600
@@ -24,27 +31,27 @@
 
 - name: Create selinux custom policy drop folder
   file: path={{ custom_selinux_dir }} state=directory owner=root group=root mode=0750
-  when: not ssh_use_pam and sestatus.stdout == 'Enforcing'
+  when: not ssh_use_pam and sestatus.stdout != 'Disabled'
 
 # The following tasks only get executed when selinux is in state enforcing and UsePam is "no".
 # See this issue for more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
 
 - name: Distributing custom selinux policies
   copy: src='ssh_password' dest='{{ custom_selinux_dir }}'
   register: custom_policies_output
-  when: not ssh_use_pam and sestatus.stdout == 'Enforcing'
+  when: not ssh_use_pam and sestatus.stdout != 'Disabled'
 
 - name: check and compile policy
   shell: checkmodule -M -m -o {{ custom_selinux_dir }}/ssh_password.mod {{ custom_selinux_dir }}/ssh_password
-  when: not ssh_use_pam and sestatus.stdout == 'Enforcing'
+  when: not ssh_use_pam and sestatus.stdout != 'Disabled'
 
 - name: create selinux policy module package
   shell: semodule_package -o {{ custom_selinux_dir }}/ssh_password.pp  -m {{ custom_selinux_dir }}/ssh_password.mod
-  when: not ssh_use_pam and sestatus.stdout == 'Enforcing'
+  when: not ssh_use_pam and sestatus.stdout != 'Disabled'
 
 - name: install selinux policy
   shell: semodule -i {{ custom_selinux_dir }}/ssh_password.pp
-  when: not ssh_use_pam and sestatus.stdout == 'Enforcing'
+  when: not ssh_use_pam and sestatus.stdout != 'Disabled'
 
 - name: remove selinux-policy when Pam is used, because Allowing sshd to read the shadow file directly is considered a potential security risk (http://danwalsh.livejournal.com/12333.html)
   shell: semodule -r ssh_password