Add check if to continue with ansible task

[teacup-on-rockingchair]

Description:

• When run in check mode ansible remediation scripts should be more isolated and need extra checks instead of assumptions

Rationale:

• Fix ansible remediations run in check mode for rules part of the SLE ANSSI profile

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned' differs.
--- xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned
+++ xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned
@@ -142,6 +142,7 @@
     world_writable_dirs: '{{ world_writable_dirs | union(item.stdout_lines) | list
       }}'
   loop: '{{ result_found_dirs.results }}'
+  when: item is not skipped
   tags:
   - CCE-83375-6
   - DISA-STIG-RHEL-08-010700

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits' differs.
--- xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
+++ xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
@@ -163,6 +163,7 @@
     world_writable_dirs: '{{ world_writable_dirs | union(item.stdout_lines) | list
       }}'
   loop: '{{ result_found_dirs.results }}'
+  when: result_found_dirs is not skipped and item is not skipped
   tags:
   - CCE-80783-4
   - DISA-STIG-RHEL-08-010190

[codeclimate]

Code Climate has analyzed commit 40e9407 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

[teacup-on-rockingchair]

failing automatus tests seemed to be because of dir_perms_world_writable_root_owned test involves some systemd service restarting and we have no systemd on podman

[jan-cerny]

The test scenarios pass locally when using a virtual machine back end.

jcerny@fedora ~/work/git/scap-security-guide (pr/11299) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel8 --remediate-using ansible dir_perms_world_writable_root_owned dir_perms_world_writable_sticky_bits
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-12-01-1155/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned
INFO - Script all_dirs_ok.pass.sh using profile (all) OK
INFO - Script world_writable_dir_on_nonlocal_fs.fail.sh using profile (all) OK
INFO - Script world_writable_dir_owned_by_uid_2.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
INFO - Script correct.pass.sh using profile (all) OK
INFO - Script tmp_no_sticky.fail.sh using profile (all) OK
jcerny@fedora ~/work/git/scap-security-guide (pr/11299) $ python3 tests/automatus.py rule --libvirt qemu:///system ssgts_rhel9 --remediate-using ansible dir_perms_world_writable_root_owned dir_perms_world_writable_sticky_bits
Setting console output to log level INFO
INFO - The base image option has not been specified, choosing libvirt-based test environment.
INFO - Logging into /home/jcerny/work/git/scap-security-guide/logs/rule-custom-2023-12-01-1202/test_suite.log
INFO - xccdf_org.ssgproject.content_rule_dir_perms_world_writable_root_owned
INFO - Script all_dirs_ok.pass.sh using profile (all) OK
INFO - Script world_writable_dir_on_nonlocal_fs.fail.sh using profile (all) OK
INFO - Script world_writable_dir_owned_by_uid_2.fail.sh using profile (all) OK
INFO - xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits
INFO - Script correct.pass.sh using profile (all) OK
INFO - Script tmp_no_sticky.fail.sh using profile (all) OK