---
# Rocky Linux 9 with container-selinux > 2.189.0 blocks iscsiadm via SELinux,
# causing infinite attach/detach loops on Longhorn volumes.
- name: SELinux | Write iscsid CIL policy file
  ansible.builtin.copy:
    dest: /tmp/local_longhorn.cil
    content: "(allow iscsid_t self (capability (dac_override)))\n"
    mode: "0644"

- name: SELinux | Check if Longhorn policy module is already loaded
  ansible.builtin.command: semodule -l
  register: _semodule_list
  changed_when: false
  check_mode: false

- name: SELinux | Install iscsid CIL policy module
  ansible.builtin.command: semodule -vi /tmp/local_longhorn.cil
  when: "'local_longhorn' not in _semodule_list.stdout"
  register: _semodule_install
  changed_when: _semodule_install.rc == 0