Default variables

Packages and installation

apparmor__base_packages

List of base packages to install.

apparmor__base_packages:
  - 'apparmor'
  - 'apparmor-utils'
  - 'apparmor-profiles'
  - 'apparmor-profiles-extra'
apparmor__packages

List of additional packages to install.

apparmor__packages: []
apparmor__enabled

Enable or disable support the AppArmor. Since the role is included from the DebOps common playbook, this allows a manual override of the default behavior.

apparmor__enabled: '{{ ansible_local.apparmor.enabled
                       | d(False
                           if (ansible_distribution_release in ["stretch"] or
                               (ansible_virtualization_role | d("") == "guest"
                                and
                                ansible_virtualization_type | d("") in
                                  ["container"]))
                           else True) }}'
apparmor__manage_grub

Enable or disable support for adding kernel parameters via GRUB which cause the AppArmor security module to be enabled at boot. Note that the normal Debian/Ubuntu kernel packages already include and enable this support by default, so this is only necessary for old distributions and/or customized kernel builds.

apparmor__manage_grub: '{{ ansible_local.apparmor.grub_enabled
                           | d(True
                               if (apparmor__enabled | d(False) | bool and
                                   ansible_distribution_release in ["stretch"])
                               else False) }}'
apparmor__kernel_parameters

Kernel parameters needed to enable AppArmor (if not already enabled by default, as in recent Debian/Ubuntu kernel packages). Only relevant if apparmor__manage_grub is enabled.

apparmor__kernel_parameters:
  - 'apparmor=1'
  - 'security=apparmor'

AppArmor profiles

These variables control the state of individual AppArmor profiles. See apparmor__profiles for more details.

apparmor__default_profiles

List of profiles to enable/disable, defined by the role.

apparmor__default_profiles: []
apparmor__profiles

List of profiles to enable/disable, defined for all hosts in the Ansible inventory.

apparmor__profiles: []
apparmor__group_profiles

List of profiles to enable/disable, defined on hosts in a specific Ansible inventory group.

apparmor__group_profiles: []
apparmor__host_profiles

List of profiles to enable/disable, defined on specific hosts in the Ansible inventory.

apparmor__host_profiles: []
apparmor__dependent_profiles

Variable definitions managed by roles using this role as dependency.

apparmor__dependent_profiles: []
apparmor__combined_profiles

A combination of the profiles to enable/disable, defined by the other variables, used in role tasks.

apparmor__combined_profiles: '{{ apparmor__default_profiles
                                 + apparmor__profiles
                                 + apparmor__group_profiles
                                 + apparmor__host_profiles
                                 + apparmor__dependent_profiles }}'

AppArmor local profile modifications

These variables control local profile modifications. See apparmor__locals for more details.

apparmor__default_locals

List of default local profile modifications defined by the role.

apparmor__default_locals: []
apparmor__locals

List of local profile modifications defined for all hosts in the Ansible inventory.

apparmor__locals: []
apparmor__group_locals

List of local profile modifications defined on hosts in a specific Ansible inventory group.

apparmor__group_locals: []
apparmor__host_locals

List of local profile modifications defined on specific hosts in the Ansible inventory.

apparmor__host_locals: []
apparmor__dependent_locals

Variable definitions managed by roles using this role as dependency.

apparmor__dependent_locals: []
apparmor__combined_locals

A combination of the local profile modifications defined by the other variables, used in role tasks.

apparmor__combined_locals: '{{ apparmor__default_locals
                               + apparmor__locals
                               + apparmor__group_locals
                               + apparmor__host_locals
                               + apparmor__dependent_locals }}'

AppArmor tunables

These variables control profile tunables. See apparmor__tunables for more details.

apparmor__default_tunables

List of default tunables defined by the role.

apparmor__default_tunables: []
apparmor__tunables

List of tunables defined for all hosts in the Ansible inventory.

apparmor__tunables: []
apparmor__group_tunables

List of tunables defined on hosts in a specific Ansible inventory group.

apparmor__group_tunables: []
apparmor__host_tunables

List of tunables defined on specific hosts in the Ansible inventory.

apparmor__host_tunables: []
apparmor__dependent_tunables

Variable definitions managed by roles using this role as dependency.

apparmor__dependent_tunables: []
apparmor__combined_tunables

A combination of the tunables defined by the other variables, used in role tasks.

apparmor__combined_tunables: '{{ apparmor__default_tunables
                                 + apparmor__tunables
                                 + apparmor__group_tunables
                                 + apparmor__host_tunables
                                 + apparmor__dependent_tunables }}'