Fix changes in Ansible tasks not expected to fail #10427

marcusburghardt · 2023-04-04T17:06:07Z

Description:

The #10348 introduced changes in Ansible tasks aiming to satisfy some ansible-lint requirements. The most critical change was about the replacement of ignore_errors: yes by failed_when: with some new condition.

The ignore_errors: yes parameter was intentional in some tasks used to simply collect information in a register which is properly assessed by subsequent tasks to properly apply the remediation. When a conditional was included, the impacted tasks were capable to cause fatal errors during the Playbook execution, impacting in several profiles.

This PR fix this situation at the same time the ansible-lint related improvements are preserved.

Rationale:

Ensure stability of Ansible Playbooks and respect the existing Ansible remediation logic in existing rules.

Fixes Ansible tasks failing due to error controls changes #10423

The a7cdf35 caused an Ansible task to fail by replacing the "ignore_errors" parameter by "failed_when" with an additional condition. The intention was to satisfy ansible-lint. However the task is used only to collect information and should never cause a fatal error in Ansible Playbook. Instead, the result is properly tested in subsequent tasks. This commit keeps the "failed_when" parameter in order to satisfy the ansible-lint but change the condition to false.

The 733ef1f caused an Ansible task to fail by replacing the "ignore_errors" parameter by "failed_when" with an additional condition. The intention was to satisfy ansible-lint. However the task is used only to collect information and should not cause a fatal error in Ansible Playbook. Instead, the result is properly tested in subsequent tasks. This commit keeps the "failed_when" parameter in order to satisfy the ansible-lint but change the condition to false.

The a7cdf35 changed the Ansible Playbook behavior aiming to satisfy the ansible-lint. However, the change allowed a task intended to only collect information to cause a fatal error in the Playbook. The taks should not cause fatal error because its result is intentionally tested by subsequent tasks.

github-actions · 2023-04-04T17:07:57Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2023-04-04T17:11:35Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_enable_authselect' differs.
--- xccdf_org.ssgproject.content_rule_enable_authselect
+++ xccdf_org.ssgproject.content_rule_enable_authselect
@@ -8,7 +8,7 @@
 ansible.builtin.command:
 cmd: authselect select "{{ var_authselect_profile }}"
 register: result_authselect_select
- failed_when: result_authselect_select.rc not in [0, 4]
+ failed_when: false
 tags:
 - CCE-88248-0
 - NIST-800-53-AC-3

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -62,7 +62,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Ensure PAM Displays Last Logon/Access Notification - Informative message
 based on the authselect integrity check result
@@ -339,7 +339,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Ensure PAM Displays Last Logon/Access Notification - Informative message
 based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -21,7 +21,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Account Lockouts Must Be Logged - Informative message based on the authselect
 integrity check result
@@ -202,7 +202,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Account Lockouts Must Be Logged - Informative message based on the authselect
 integrity check result
@@ -369,7 +369,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Account Lockouts Must Be Logged - Informative message based on the authselect
 integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -80,7 +80,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: password-auth - Informative message based on the
 authselect integrity check result'
@@ -165,7 +165,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: password-auth - Informative message based on the
 authselect integrity check result'
@@ -431,7 +431,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: password-auth - Informative message based on
 the authselect integrity check result'
@@ -613,7 +613,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: password-auth - Informative message based on the
 authselect integrity check result'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -80,7 +80,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: system-auth - Informative message based on the authselect
 integrity check result'
@@ -165,7 +165,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: system-auth - Informative message based on the
 authselect integrity check result'
@@ -431,7 +431,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: system-auth - Informative message based on
 the authselect integrity check result'
@@ -612,7 +612,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: 'Limit Password Reuse: system-auth - Informative message based on the
 authselect integrity check result'

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -72,7 +72,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Limit Password Reuse - Informative message based on the authselect integrity
 check result
@@ -153,7 +153,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Limit Password Reuse - Informative message based on the authselect integrity
 check result
@@ -410,7 +410,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Limit Password Reuse - Informative message based on the authselect
 integrity check result
@@ -584,7 +584,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Limit Password Reuse - Informative message based on the authselect integrity
 check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -22,7 +22,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Account Lockouts Must Be Logged - Informative message based on the authselect
 integrity check result
@@ -207,7 +207,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Account Lockouts Must Be Logged - Informative message based on the authselect
 integrity check result
@@ -374,7 +374,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Account Lockouts Must Be Logged - Informative message based on the authselect
 integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -49,7 +49,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Lock Accounts After Failed Password Attempts - Informative message based
 on the authselect integrity check result
@@ -269,7 +269,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Lock Accounts After Failed Password Attempts - Informative message based
 on the authselect integrity check result
@@ -441,7 +441,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Lock Accounts After Failed Password Attempts - Informative message based
 on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -43,7 +43,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Configure the root Account for Failed Password Attempts - Informative message
 based on the authselect integrity check result
@@ -247,7 +247,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Configure the root Account for Failed Password Attempts - Informative
 message based on the authselect integrity check result
@@ -419,7 +419,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Configure the root Account for Failed Password Attempts - Informative
 message based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -40,7 +40,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Lock Accounts Must Persist - Informative message based on the authselect
 integrity check result
@@ -240,7 +240,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Lock Accounts Must Persist - Informative message based on the authselect
 integrity check result
@@ -404,7 +404,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Lock Accounts Must Persist - Informative message based on the authselect
 integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -37,7 +37,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Enforce pam_faillock for Local Accounts Only - Informative message based
 on the authselect integrity check result
@@ -228,7 +228,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Enforce pam_faillock for Local Accounts Only - Informative message based
 on the authselect integrity check result
@@ -400,7 +400,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Enforce pam_faillock for Local Accounts Only - Informative message based
 on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
@@ -41,7 +41,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set Interval For Counting Failed Password Attempts - Informative message
 based on the authselect integrity check result
@@ -246,7 +246,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set Interval For Counting Failed Password Attempts - Informative message
 based on the authselect integrity check result
@@ -418,7 +418,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set Interval For Counting Failed Password Attempts - Informative message
 based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_silent' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_silent
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_silent
@@ -37,7 +37,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Informative
 message based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
@@ -49,7 +49,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set Lockout Time for Failed Password Attempts - Informative message based
 on the authselect integrity check result
@@ -269,7 +269,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set Lockout Time for Failed Password Attempts - Informative message
 based on the authselect integrity check result
@@ -441,7 +441,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set Lockout Time for Failed Password Attempts - Informative message
 based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
@@ -52,7 +52,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Ensure PAM password complexity module is enabled in password-auth - Informative
 message based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -52,7 +52,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Ensure PAM password complexity module is enabled in system-auth - Informative
 message based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -87,7 +87,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
 Permitted Per-Session - Informative message based on the authselect integrity
@@ -295,7 +295,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
 Permitted Per-Session - Informative message based on the authselect integrity

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -64,7 +64,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set PAM's Password Hashing Algorithm - password-auth - Informative message
 based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -66,7 +66,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set PAM's Password Hashing Algorithm - Informative message based on the
 authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -55,7 +55,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set number of Password Hashing Rounds - password-auth - Informative message
 based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -55,7 +55,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Set number of Password Hashing Rounds - system-auth - Informative message
 based on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_no_empty_passwords' differs.
--- xccdf_org.ssgproject.content_rule_no_empty_passwords
+++ xccdf_org.ssgproject.content_rule_no_empty_passwords
@@ -32,7 +32,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Prevent Login to Accounts With Empty Password - Informative message based
 on the authselect integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_enable_smartcards' differs.
--- xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
+++ xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
@@ -116,7 +116,7 @@
 cmd: authselect check
 register: result_authselect_check_cmd
 changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
 
 - name: Enable Smartcards in SSSD - Informative message based on the authselect
 integrity check result

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_ca_dir' differs.
--- xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_ca_dir
+++ xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_ca_dir
@@ -21,7 +21,7 @@
 command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
 /etc/sssd/sssd.conf
 register: test_id_provider
- failed_when: test_id_provider.rc not in [0, 1]
+ failed_when: false
 changed_when: false
 check_mode: false
 when:
@@ -41,7 +41,7 @@
 - name: Test for domain group
 command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
 register: test_grep_domain
- failed_when: test_grep_domain.rc not in [0, 1]
+ failed_when: false
 changed_when: false
 check_mode: false
 when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert' differs.
--- xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert
+++ xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert
@@ -16,7 +16,7 @@
 command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
 /etc/sssd/sssd.conf
 register: test_id_provider
- failed_when: test_id_provider.rc not in [0, 1]
+ failed_when: false
 changed_when: false
 check_mode: false
 when:
@@ -36,7 +36,7 @@
 - name: Test for domain group
 command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
 register: test_grep_domain
- failed_when: test_grep_domain.rc not in [0, 1]
+ failed_when: false
 changed_when: false
 check_mode: false
 when:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_ldap_start_tls' differs.
--- xccdf_org.ssgproject.content_rule_sssd_ldap_start_tls
+++ xccdf_org.ssgproject.content_rule_sssd_ldap_start_tls
@@ -17,7 +17,7 @@
 command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
 /etc/sssd/sssd.conf
 register: test_id_provider
- failed_when: test_id_provider.rc not in [0, 1]
+ failed_when: false
 changed_when: false
 check_mode: false
 when:
@@ -38,7 +38,7 @@
 - name: Test for domain group
 command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
 register: test_grep_domain
- failed_when: test_grep_domain.rc not in [0, 1]
+ failed_when: false
 changed_when: false
 check_mode: false
 when:

codeclimate · 2023-04-04T17:58:15Z

Code Climate has analyzed commit 2db4528 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 52.4% (0.0% change).

View more on Code Climate.

jan-cerny

The AutoMatus fail is also reproducible on current master and that means it isn't caused by the contents of this PR. I have reported in issue #10429.

marcusburghardt added 3 commits April 4, 2023 13:34

marcusburghardt added bugfix Fixes to reported bugs. Ansible Ansible remediation update. labels Apr 4, 2023

marcusburghardt added this to the 0.1.68 milestone Apr 4, 2023

marcusburghardt requested review from Mab879, jan-cerny and mildas April 4, 2023 17:06

marcusburghardt mentioned this pull request Apr 4, 2023

Ansible tasks failing due to error controls changes #10423

Closed

jan-cerny self-assigned this Apr 5, 2023

jan-cerny mentioned this pull request Apr 5, 2023

Rule enable_authselect fails a test scenario #10429

Closed

jan-cerny approved these changes Apr 5, 2023

View reviewed changes

jan-cerny merged commit f4d8d9b into ComplianceAsCode:master Apr 5, 2023

marcusburghardt deleted the fix_10423 branch April 5, 2023 12:59

marcusburghardt mentioned this pull request Apr 11, 2023

Authselect Integrity Check Failed During Ansible Playbook Runs #10447

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix changes in Ansible tasks not expected to fail #10427

Fix changes in Ansible tasks not expected to fail #10427

marcusburghardt commented Apr 4, 2023

github-actions bot commented Apr 4, 2023

github-actions bot commented Apr 4, 2023

codeclimate bot commented Apr 4, 2023

jan-cerny left a comment

Fix changes in Ansible tasks not expected to fail #10427

Fix changes in Ansible tasks not expected to fail #10427

Conversation

marcusburghardt commented Apr 4, 2023

Description:

Rationale:

github-actions bot commented Apr 4, 2023

github-actions bot commented Apr 4, 2023

codeclimate bot commented Apr 4, 2023

jan-cerny left a comment

Choose a reason for hiding this comment