---
- name: check if selinux is enabled
  command: getenforce
  register: sestatus
  changed_when: false
  always_run: true

- name: set selinux permissions
  shell: |
    chcon -Rt svirt_sandbox_file_t {{ item }}
  with_items:
    - "{{ ceph_conf_key_directory }}"
    - /var/lib/ceph
  changed_when: false
  when: sestatus.stdout != 'Disabled'