---
- name: check if selinux is enabled
  command: getenforce
  register: sestatus
  changed_when: false
  always_run: true

- name: set selinux permissions
  shell: chcon -Rt svirt_sandbox_file_t {{ item }}
  with_items:
    - /etc/ceph
    - /var/lib/ceph
  changed_when: false
  when: sestatus.stdout != 'Disabled'