---
- name: Determine if system is ostree and set flag
  when: not __selinux_is_ostree is defined
  block:
    - name: Check if system is ostree
      stat:
        path: /run/ostree-booted
      register: __ostree_booted_stat

    - name: Set flag to indicate system is ostree
      set_fact:
        __selinux_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"

- name: Determine if system is transactional update and set flag
  when: not __selinux_is_transactional is defined
  block:
    - name: Check if transactional-update exists in /sbin
      stat:
        path: /sbin/transactional-update
      register: __transactional_update_stat

    - name: Set flag if transactional-update exists
      set_fact:
        __selinux_is_transactional: "{{ __transactional_update_stat.stat.exists }}"

- name: Install SELinux python2 tools
  package:
    name:
      - libselinux-python
      - policycoreutils-python
    state: present
    use: "{{ (__selinux_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  when: ansible_python_version is version('3', '<')

- name: Install SELinux python3 tools
  package:
    name:
      - python3-libselinux
      - python3-policycoreutils
    state: present
    use: "{{ (__selinux_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  when:
    - ansible_python_version is version('3', '>=')
    - ansible_os_family == "RedHat"

- name: Install SELinux python3 tools
  package:
    name:
      - python3-selinux
      - python3-policycoreutils
    state: present
    use: "{{ (__selinux_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  when:
    - ansible_python_version is version('3', '>=')
    - ansible_os_family == "Suse"
  register: selinux_python3_tools_result

- name: Ensure grubby used to modify selinux kernel parameter
  package:
    name: grubby
    state: present
    use: "{{ (__selinux_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  when:
    - ansible_facts["os_family"] == "RedHat"
    - ansible_facts["distribution_major_version"] is version("8", ">=")

- name: Install SELinux tool semanage
  package:
    name:
      - policycoreutils-python-utils
    state: present
    use: "{{ (__selinux_is_ostree | d(false)) |
             ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
  when: ansible_distribution == "Fedora" or
    ansible_distribution == "SL-Micro" or
    (ansible_distribution_major_version | int > 7 and
     ansible_distribution in ["CentOS", "RedHat", "Rocky"])
  register: selinux_semanage_result

- name: Handle reboot for transactional update systems
  when:
    - __selinux_is_transactional | d(false)
    - selinux_python3_tools_result is changed or
      selinux_semanage_result is changed
  block:
    - name: Notify user that reboot is needed to apply changes
      debug:
        msg: >
          Reboot required to apply changes due to transactional updates.

    - name: Reboot transactional update systems
      reboot:
        msg: Rebooting the system to apply transactional update changes.
      when: selinux_transactional_update_reboot_ok | bool

    - name: Fail if reboot is needed and not set
      fail:
        msg: >
          Reboot is required but not allowed. Please set 'selinux_transactional_update_reboot_ok' to proceed.
      when:
        - selinux_transactional_update_reboot_ok is none

- name: Refresh facts
  setup:
    filter: ansible_selinux
  when: not __selinux_setup_snapshot | d(false)
