-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Sle15 fix ansible pci-dss remediations in check mode #11263
Sle15 fix ansible pci-dss remediations in check mode #11263
Conversation
This datastream diff is auto generated by the check Click here to see the full diffansible remediation for rule 'xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled' differs.
--- xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
+++ xccdf_org.ssgproject.content_rule_ensure_gpgcheck_never_disabled
@@ -35,8 +35,9 @@
option: gpgcheck
value: '1'
no_extra_spaces: true
- loop: '{{ repo_grep_results.stdout | regex_findall( ''(.+\.repo):\[(.+)\]\n?'' )
- }}'
+ loop: '{{ repo_grep_results.stdout |regex_findall( ''(.+\.repo):\[(.+)\]\n?'' )
+ if repo_grep_results is not skipped else []}}'
+ when: repo_grep_results is not skipped
tags:
- CCE-80792-5
- CJIS-5.10.4.1
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit
+++ xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit
@@ -48,7 +48,7 @@
when:
- '"audit" in ansible_facts.packages'
- ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
- - (log_file_exists.stdout | length > 0)
+ - log_file_exists is not skipped and (log_file_exists.stdout | length > 0)
tags:
- CCE-80819-6
- CJIS-5.4.1.1
@@ -72,7 +72,8 @@
when:
- '"audit" in ansible_facts.packages'
- ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
- - (log_file_exists is undefined) or (log_file_exists.stdout | length == 0)
+ - (log_file_exists is skipped) or (log_file_exists is undefined) or (log_file_exists.stdout
+ | length == 0)
tags:
- CCE-80819-6
- CJIS-5.4.1.1
@@ -96,7 +97,8 @@
when:
- '"audit" in ansible_facts.packages'
- ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
- - (log_file_line.stdout is defined) and (log_file_line.stdout | length > 0)
+ - (log_file_exists is not skipped) and (log_file_line.stdout is defined) and (log_file_line.stdout
+ | length > 0)
tags:
- CCE-80819-6
- CJIS-5.4.1.1
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands
+++ xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands
@@ -75,11 +75,13 @@
- name: Ensure auditd Collects Information on the Use of Privileged Commands - Set
List of Privileged Commands Found in Eligible Mount Points
ansible.builtin.set_fact:
- privileged_commands: '{{( result_privileged_commands_search.results | map(attribute=''stdout_lines'')
- | select() | list ) | sum(start=[]) }}'
+ privileged_commands: '{{ privileged_commands | default([]) + item.stdout_lines
+ }}'
+ loop: '{{ result_privileged_commands_search.results }}'
when:
- '"audit" in ansible_facts.packages'
- ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - item is not skipped
tags:
- CCE-80724-8
- CJIS-5.4.1.1
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
+++ xccdf_org.ssgproject.content_rule_rsyslog_files_groupownership
@@ -63,7 +63,9 @@
ansible.builtin.set_fact:
include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
}}'
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
tags:
- CCE-80860-0
- NIST-800-53-AC-6(1)
@@ -85,10 +87,12 @@
hidden: false
follow: true
loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - include_config_output is defined
register: rsyslog_config_files
failed_when: false
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-80860-0
- NIST-800-53-AC-6(1)
@@ -109,10 +113,12 @@
grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
awk '{print $NF}' | \
sed -e 's/^-//' || true
- loop: '{{ rsyslog_config_files.results | subelements(''files'') }}'
+ loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
register: log_files_old
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_config_files is not skipped
tags:
- CCE-80860-0
- NIST-800-53-AC-6(1)
@@ -134,10 +140,12 @@
grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
tr -d "\""|| true
- loop: '{{ rsyslog_config_files.results | subelements(''files'') }}'
+ loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
register: log_files_new
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_config_files is not skipped
tags:
- CCE-80860-0
- NIST-800-53-AC-6(1)
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_ownership' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_files_ownership
+++ xccdf_org.ssgproject.content_rule_rsyslog_files_ownership
@@ -63,7 +63,9 @@
ansible.builtin.set_fact:
include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
}}'
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
tags:
- CCE-80861-8
- NIST-800-53-AC-6(1)
@@ -85,10 +87,12 @@
hidden: false
follow: true
loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - include_config_output is defined
register: rsyslog_config_files
failed_when: false
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-80861-8
- NIST-800-53-AC-6(1)
@@ -109,10 +113,12 @@
grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
awk '{print $NF}' | \
sed -e 's/^-//' || true
- loop: '{{ rsyslog_config_files.results | subelements(''files'') }}'
+ loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
register: log_files_old
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_config_files is not skipped
tags:
- CCE-80861-8
- NIST-800-53-AC-6(1)
@@ -134,10 +140,12 @@
grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
tr -d "\""|| true
- loop: '{{ rsyslog_config_files.results | subelements(''files'') }}'
+ loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
register: log_files_new
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_config_files is not skipped
tags:
- CCE-80861-8
- NIST-800-53-AC-6(1)
ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions' differs.
--- xccdf_org.ssgproject.content_rule_rsyslog_files_permissions
+++ xccdf_org.ssgproject.content_rule_rsyslog_files_permissions
@@ -63,7 +63,9 @@
ansible.builtin.set_fact:
include_config_output: '{{ rsyslog_old_inc.stdout_lines + rsyslog_new_inc.stdout_lines
}}'
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_old_inc is not skipped and rsyslog_new_inc is not skipped
tags:
- CCE-80862-6
- NIST-800-53-AC-6(1)
@@ -85,10 +87,12 @@
hidden: false
follow: true
loop: '{{ include_config_output | list + [rsyslog_etc_config] }}'
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - include_config_output is defined
register: rsyslog_config_files
failed_when: false
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
- CCE-80862-6
- NIST-800-53-AC-6(1)
@@ -109,10 +113,12 @@
grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item.1.path }} | \
awk '{print $NF}' | \
sed -e 's/^-//' || true
- loop: '{{ rsyslog_config_files.results | subelements(''files'') }}'
+ loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
register: log_files_old
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_config_files is not skipped
tags:
- CCE-80862-6
- NIST-800-53-AC-6(1)
@@ -134,10 +140,12 @@
grep -aoP "File\s*=\s*\"([/[:alnum:][:punct:]]*)\"\s*\)" | \
grep -oE "\"([/[:alnum:][:punct:]]*)\"" | \
tr -d "\""|| true
- loop: '{{ rsyslog_config_files.results | subelements(''files'') }}'
+ loop: '{{ rsyslog_config_files.results | default([]) | subelements(''files'') }}'
register: log_files_new
changed_when: false
- when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ when:
+ - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+ - rsyslog_config_files is not skipped
tags:
- CCE-80862-6
- NIST-800-53-AC-6(1) |
Can you please rebase this PR? We updated the Ansible lint CI job and I would like to run it on this PR. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello @teacup-on-rockingchair could you please explain what is the goal of these changes? Is there a test scenario which I could use to prove that previous Ansible did not work as expected and now it works?
Thank you.
@@ -23,4 +23,5 @@ | |||
value: '1' | |||
no_extra_spaces: True | |||
# regex filters grep output for files ending in .repo and matching section names. | |||
loop: "{{ repo_grep_results.stdout | regex_findall( '(.+\\.repo):\\[(.+)\\]\\n?' ) }}" | |||
loop: "{{ repo_grep_results.stdout |regex_findall( '(.+\\.repo):\\[(.+)\\]\\n?' ) if repo_grep_results is not skipped else []}}" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this change needed in case we consider the next line with the "when" clause?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
well both to answer both to this and the above question the extra checks added are handling the case when run ansible remediation is run in check mode in a similar way:
ansible-playbook -i /root/ansible_inventory.yml sle15-playbook-pci-dss.yml --check --diff
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi @vojtapolasek does this PR causes any issues that I am missing, if not can you please approve it 🙏
a9db6c7
to
08d6c3f
Compare
Code Climate has analyzed commit 08d6c3f and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5%. View more on Code Climate. |
Hello @teacup-on-rockingchair I would like to merge the PR, but I still don't understand its purpose. I tried to do the following with master branch checked out and later with this PR checked out:
I thought it will show me different output but the output was exactly the same. |
Hi @vojtapolasek , sorry for the much delayed reply but was on a long vacation. So to return to this, what I use to reproduce it is following command (which is not much different than yours):
if I run the same command and try to get more verbose output , adding
so the source of the issue here in my understanding that the greping task is skipped in check mode, since it is command type of task and is skipped, but the next tasks rely on it, so there goes in the patch that was done. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hello, thank you for explaining it. I think I understand the changes. I did not manage to reproduce those fatal failures in my environment, but I think the changes are fine.
Description:
Rationale: