Harden Atlas USB backup cleanup and document restorecon workflow

ansible/roles/profile_atlas/tasks/main.yml

@@ -23,6 +23,9 @@
 - name: Import Atlas offline USB backup tasks
   ansible.builtin.import_tasks: usb_backup.yml
 
+- name: Import Atlas post-restore SELinux relabeling tasks
+  ansible.builtin.import_tasks: restorecon.yml
+
 - name: Import Atlas file sharing tasks
   ansible.builtin.import_tasks: sharing.yml
 

ansible/roles/profile_atlas/tasks/restorecon.yml

@@ -0,0 +1,27 @@
+---
+- name: Validate requested Atlas post-restore relabel paths
+  tags: [atlas, restorecon, recovery]
+  ansible.builtin.assert:
+    that:
+      - item is string
+      - item.startswith(atlas_mount_root ~ '/')
+      - item != atlas_mount_root
+    fail_msg: >-
+      Post-restore relabeling accepts only explicit paths below the Atlas pool
+      mount root. Do not relabel the whole pool during routine provisioning.
+  loop: "{{ atlas_restorecon_paths }}"
+  when: atlas_restorecon_paths | length > 0
+
+- name: Restore SELinux labels on explicitly restored Atlas paths
+  tags: [atlas, restorecon, recovery]
+  ansible.builtin.command:
+    argv:
+      - restorecon
+      - -RFv
+      - "{{ item }}"
+  register: atlas_restorecon_result
+  changed_when: atlas_restorecon_result.stdout | length > 0
+  loop: "{{ atlas_restorecon_paths }}"
+  when:
+    - atlas_restorecon_paths | length > 0
+    - not ansible_check_mode

ansible/roles/profile_atlas/tasks/usb_backup.yml

@@ -36,6 +36,16 @@
     mode: "0750"
   when: atlas_manage_usb_backup | bool
 
+- name: Install the Atlas USB snapshot cleanup helper
+  tags: [atlas, storage, backup, usb_backup]
+  ansible.builtin.template:
+    src: atlas-usb-snapshot-cleanup.sh.j2
+    dest: /usr/local/sbin/atlas-usb-snapshot-cleanup
+    owner: root
+    group: root
+    mode: "0750"
+  when: atlas_manage_usb_backup | bool
+
 - name: Install the manual Atlas offline USB backup service
   tags: [atlas, storage, backup, usb_backup]
   ansible.builtin.template: