-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix changes in Ansible tasks not expected to fail #10427
Conversation
The a7cdf35 caused an Ansible task to fail by replacing the "ignore_errors" parameter by "failed_when" with an additional condition. The intention was to satisfy ansible-lint. However the task is used only to collect information and should never cause a fatal error in Ansible Playbook. Instead, the result is properly tested in subsequent tasks. This commit keeps the "failed_when" parameter in order to satisfy the ansible-lint but change the condition to false.
The 733ef1f caused an Ansible task to fail by replacing the "ignore_errors" parameter by "failed_when" with an additional condition. The intention was to satisfy ansible-lint. However the task is used only to collect information and should not cause a fatal error in Ansible Playbook. Instead, the result is properly tested in subsequent tasks. This commit keeps the "failed_when" parameter in order to satisfy the ansible-lint but change the condition to false.
The a7cdf35 changed the Ansible Playbook behavior aiming to satisfy the ansible-lint. However, the change allowed a task intended to only collect information to cause a fatal error in the Playbook. The taks should not cause fatal error because its result is intentionally tested by subsequent tasks.
This datastream diff is auto generated by the check Click here to see the full diffansible remediation for rule 'xccdf_org.ssgproject.content_rule_enable_authselect' differs.
--- xccdf_org.ssgproject.content_rule_enable_authselect
+++ xccdf_org.ssgproject.content_rule_enable_authselect
@@ -8,7 +8,7 @@
ansible.builtin.command:
cmd: authselect select "{{ var_authselect_profile }}"
register: result_authselect_select
- failed_when: result_authselect_select.rc not in [0, 4]
+ failed_when: false
tags:
- CCE-88248-0
- NIST-800-53-AC-3
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -62,7 +62,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Ensure PAM Displays Last Logon/Access Notification - Informative message
based on the authselect integrity check result
@@ -339,7 +339,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Ensure PAM Displays Last Logon/Access Notification - Informative message
based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -21,7 +21,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Account Lockouts Must Be Logged - Informative message based on the authselect
integrity check result
@@ -202,7 +202,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Account Lockouts Must Be Logged - Informative message based on the authselect
integrity check result
@@ -369,7 +369,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Account Lockouts Must Be Logged - Informative message based on the authselect
integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -80,7 +80,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: password-auth - Informative message based on the
authselect integrity check result'
@@ -165,7 +165,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: password-auth - Informative message based on the
authselect integrity check result'
@@ -431,7 +431,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: password-auth - Informative message based on
the authselect integrity check result'
@@ -613,7 +613,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: password-auth - Informative message based on the
authselect integrity check result'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -80,7 +80,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: system-auth - Informative message based on the authselect
integrity check result'
@@ -165,7 +165,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: system-auth - Informative message based on the
authselect integrity check result'
@@ -431,7 +431,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: system-auth - Informative message based on
the authselect integrity check result'
@@ -612,7 +612,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: 'Limit Password Reuse: system-auth - Informative message based on the
authselect integrity check result'
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -72,7 +72,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Limit Password Reuse - Informative message based on the authselect integrity
check result
@@ -153,7 +153,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Limit Password Reuse - Informative message based on the authselect integrity
check result
@@ -410,7 +410,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Limit Password Reuse - Informative message based on the authselect
integrity check result
@@ -584,7 +584,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Limit Password Reuse - Informative message based on the authselect integrity
check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -22,7 +22,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Account Lockouts Must Be Logged - Informative message based on the authselect
integrity check result
@@ -207,7 +207,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Account Lockouts Must Be Logged - Informative message based on the authselect
integrity check result
@@ -374,7 +374,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Account Lockouts Must Be Logged - Informative message based on the authselect
integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -49,7 +49,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Lock Accounts After Failed Password Attempts - Informative message based
on the authselect integrity check result
@@ -269,7 +269,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Lock Accounts After Failed Password Attempts - Informative message based
on the authselect integrity check result
@@ -441,7 +441,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Lock Accounts After Failed Password Attempts - Informative message based
on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -43,7 +43,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Configure the root Account for Failed Password Attempts - Informative message
based on the authselect integrity check result
@@ -247,7 +247,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Configure the root Account for Failed Password Attempts - Informative
message based on the authselect integrity check result
@@ -419,7 +419,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Configure the root Account for Failed Password Attempts - Informative
message based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -40,7 +40,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Lock Accounts Must Persist - Informative message based on the authselect
integrity check result
@@ -240,7 +240,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Lock Accounts Must Persist - Informative message based on the authselect
integrity check result
@@ -404,7 +404,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Lock Accounts Must Persist - Informative message based on the authselect
integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -37,7 +37,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Enforce pam_faillock for Local Accounts Only - Informative message based
on the authselect integrity check result
@@ -228,7 +228,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Enforce pam_faillock for Local Accounts Only - Informative message based
on the authselect integrity check result
@@ -400,7 +400,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Enforce pam_faillock for Local Accounts Only - Informative message based
on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
@@ -41,7 +41,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set Interval For Counting Failed Password Attempts - Informative message
based on the authselect integrity check result
@@ -246,7 +246,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set Interval For Counting Failed Password Attempts - Informative message
based on the authselect integrity check result
@@ -418,7 +418,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set Interval For Counting Failed Password Attempts - Informative message
based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_silent' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_silent
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_silent
@@ -37,7 +37,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Do Not Show System Messages When Unsuccessful Logon Attempts Occur - Informative
message based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
@@ -49,7 +49,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set Lockout Time for Failed Password Attempts - Informative message based
on the authselect integrity check result
@@ -269,7 +269,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set Lockout Time for Failed Password Attempts - Informative message
based on the authselect integrity check result
@@ -441,7 +441,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set Lockout Time for Failed Password Attempts - Informative message
based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
@@ -52,7 +52,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Ensure PAM password complexity module is enabled in password-auth - Informative
message based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -52,7 +52,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Ensure PAM password complexity module is enabled in system-auth - Informative
message based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -87,7 +87,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
Permitted Per-Session - Informative message based on the authselect integrity
@@ -295,7 +295,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
Permitted Per-Session - Informative message based on the authselect integrity
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -64,7 +64,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set PAM's Password Hashing Algorithm - password-auth - Informative message
based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -66,7 +66,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set PAM's Password Hashing Algorithm - Informative message based on the
authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -55,7 +55,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set number of Password Hashing Rounds - password-auth - Informative message
based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -55,7 +55,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Set number of Password Hashing Rounds - system-auth - Informative message
based on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_no_empty_passwords' differs.
--- xccdf_org.ssgproject.content_rule_no_empty_passwords
+++ xccdf_org.ssgproject.content_rule_no_empty_passwords
@@ -32,7 +32,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Prevent Login to Accounts With Empty Password - Informative message based
on the authselect integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_enable_smartcards' differs.
--- xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
+++ xccdf_org.ssgproject.content_rule_sssd_enable_smartcards
@@ -116,7 +116,7 @@
cmd: authselect check
register: result_authselect_check_cmd
changed_when: false
- failed_when: result_authselect_check_cmd.rc not in [0, 3, 4]
+ failed_when: false
- name: Enable Smartcards in SSSD - Informative message based on the authselect
integrity check result
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_ca_dir' differs.
--- xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_ca_dir
+++ xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_ca_dir
@@ -21,7 +21,7 @@
command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
/etc/sssd/sssd.conf
register: test_id_provider
- failed_when: test_id_provider.rc not in [0, 1]
+ failed_when: false
changed_when: false
check_mode: false
when:
@@ -41,7 +41,7 @@
- name: Test for domain group
command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
register: test_grep_domain
- failed_when: test_grep_domain.rc not in [0, 1]
+ failed_when: false
changed_when: false
check_mode: false
when:
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert' differs.
--- xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert
+++ xccdf_org.ssgproject.content_rule_sssd_ldap_configure_tls_reqcert
@@ -16,7 +16,7 @@
command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
/etc/sssd/sssd.conf
register: test_id_provider
- failed_when: test_id_provider.rc not in [0, 1]
+ failed_when: false
changed_when: false
check_mode: false
when:
@@ -36,7 +36,7 @@
- name: Test for domain group
command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
register: test_grep_domain
- failed_when: test_grep_domain.rc not in [0, 1]
+ failed_when: false
changed_when: false
check_mode: false
when:
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_ldap_start_tls' differs.
--- xccdf_org.ssgproject.content_rule_sssd_ldap_start_tls
+++ xccdf_org.ssgproject.content_rule_sssd_ldap_start_tls
@@ -17,7 +17,7 @@
command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$'
/etc/sssd/sssd.conf
register: test_id_provider
- failed_when: test_id_provider.rc not in [0, 1]
+ failed_when: false
changed_when: false
check_mode: false
when:
@@ -38,7 +38,7 @@
- name: Test for domain group
command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
register: test_grep_domain
- failed_when: test_grep_domain.rc not in [0, 1]
+ failed_when: false
changed_when: false
check_mode: false
when: |
Code Climate has analyzed commit 2db4528 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 52.4% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The AutoMatus fail is also reproducible on current master and that means it isn't caused by the contents of this PR. I have reported in issue #10429.
Description:
The #10348 introduced changes in Ansible tasks aiming to satisfy some
ansible-lint
requirements. The most critical change was about the replacement ofignore_errors: yes
byfailed_when:
with some new condition.The
ignore_errors: yes
parameter was intentional in some tasks used to simply collect information in a register which is properly assessed by subsequent tasks to properly apply the remediation. When a conditional was included, the impacted tasks were capable to cause fatal errors during the Playbook execution, impacting in several profiles.This PR fix this situation at the same time the
ansible-lint
related improvements are preserved.Rationale:
Ensure stability of Ansible Playbooks and respect the existing Ansible remediation logic in existing rules.