---
- name: Ensure the default is targeted, enforcing, without local modifications
  hosts: all
  tags:
  # (un)mounting SELinux fs does not work in container builds
    - tests::booted
  gather_facts: true
  vars:
    selinux_all_purge: true
    selinux_policy: targeted
    selinux_state: enforcing
    semanage_change: |
      boolean -m --on daemons_use_tcp_wrapper
      port -a -p tcp -t ssh_port_t 22100
      fcontext -a -t user_home_dir_t /tmp/test_dir
      login -a -s staff_u sar-user

  tasks:
    - name: Ensure SELinux test packages
      include_tasks:
        file: set_selinux_variables.yml
      vars:
        __selinux_get_test_facts: false
        __selinux_need_findmnt: true

    - name: Add a Linux System Roles SELinux User
      user:
        comment: Linux System Roles SELinux User
        name: sar-user
    - name: Add some mapping
      shell: |-
        set -euo pipefail
        echo -e -n "{{ semanage_change }}" | /usr/sbin/semanage -i -
      changed_when: false
    - name: Backup original /etc/selinux/config
      copy:
        remote_src: true
        src: /etc/selinux/config
        dest: /etc/selinux/config.test_selinux_disabled
        mode: preserve
    - name: Upload testing /etc/selinux/config
      copy:
        src: selinux.config
        dest: /etc/selinux/config
        mode: preserve
    - name: Switch to permissive to allow login when selinuxfs is not mounted
      command: setenforce 0
      changed_when: false
      when: ansible_selinux.status != "disabled"
    - name: Get selinuxfs mountpoint
      command: findmnt -n -t selinuxfs --output=target
      changed_when: false
      register: selinux_mountpoint
    - name: >-
        Umount selinux mountpoint to emulate SELinux disabled
        system {{ selinux_mountpoint.stdout }}
      command: umount -l {{ selinux_mountpoint.stdout }}
      changed_when: false

    - name: Execute the role and catch errors
      block:
        - name: Include role
          include_role:
            name: fedora.linux_system_roles.selinux
      rescue:
        - name: Examine the selinux_reboot_required variable
          set_fact:
            test_selinux_reboot_required: "{{ selinux_reboot_required }}"

    - name: Check that the role has failed and set the correct variable
      assert:
        that: test_selinux_reboot_required | bool
        msg: "test_selinux_reboot_required should be True instead of {{ test_selinux_reboot_required }}"
    - name: >-
        Mount selinux mountpoint back to
        system {{ selinux_mountpoint.stdout }}
    # noqa command-instead-of-module
      command: >-
        mount -t selinuxfs selinuxfs {{ selinux_mountpoint.stdout }}
      changed_when: false
    - name: Switch back to enforcing
      command: setenforce 1
      changed_when: false
    - name: Gather facts again
      setup:
    - name: Check SELinux config mode
      assert:
        that: ansible_selinux.config_mode == 'enforcing'
        msg: "SELinux config mode should be enforcing instead of {{ ansible_selinux.config_mode }}"

    - name: Cleanup
      tags: ['tests::cleanup']
      block:
        - name: Restore original /etc/selinux/config
          copy:
            remote_src: true
            dest: /etc/selinux/config
            src: /etc/selinux/config.test_selinux_disabled
            mode: preserve

        - name: Remove /etc/selinux/config backup
          file:
            path: /etc/selinux/config.test_selinux_disabled
            state: absent

        - name: Remove Linux System Roles SELinux User
          user:
            name: sar-user
            remove: true
            state: absent

        - name: Include role to purge everything
          include_role:
            name: fedora.linux_system_roles.selinux
          vars:
            selinux_all_purge: true
