Set pipefail in Ansible shell commands with pipe

[yuumasato]

Description:

• Set pipefail, so that the task fails if any part of the shell command fails.
• The shell commands can fail during the grep command, and that is fine.
  So incorporated the same technique employed in pipefail not really compatible with grep #6779

Rationale:

• Fix Ansible role linting for rule rsyslog_files_permissions

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions' differs:
--- old datastream
+++ new datastream
@@ -17,8 +17,11 @@
 - rsyslog_files_permissions
 
 - name: Get IncludeConfig directive
- shell: grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2
+ shell: |
+ set -o pipefail
+ grep -e '$IncludeConfig' {{ rsyslog_etc_config }} | cut -d ' ' -f 2 || true
 register: include_config_output
+ changed_when: false
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80862-6
@@ -34,9 +37,11 @@
 - rsyslog_files_permissions
 
 - name: Get include files directives
- shell: grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut -d"\""
- -f 2
+ shell: |
+ set -o pipefail
+ grep -oP '^\s*include\s*\(\s*file.*' {{ rsyslog_etc_config }} |cut -d"\"" -f 2 || true
 register: include_files_output
+ changed_when: false
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80862-6
@@ -56,6 +61,7 @@
 loop: '{{ include_config_output.stdout_lines + include_files_output.stdout_lines
 }}'
 register: rsyslog_config_files
+ changed_when: false
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80862-6
@@ -71,11 +77,13 @@
 - rsyslog_files_permissions
 
 - name: Extract log files
- shell: grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item }} |awk
- '{print $NF}'|sed -e 's/^-//'
+ shell: |
+ set -o pipefail
+ grep -oP '^[^(\s|#|\$)]+[\s]+.*[\s]+-?(/+[^:;\s]+);*\.*$' {{ item }} |awk '{print $NF}'|sed -e 's/^-//'
 loop: '{{ rsyslog_config_files.results|map(attribute=''stdout_lines'')|list|flatten|unique
 + [ rsyslog_etc_config ] }}'
 register: log_files
+ changed_when: false
 when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80862-6

[vojtapolasek]

It seems that Ansible remediation is failing for some test scenarios. I tested on RHEL8:
INFO - Script include_perms_0601.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in fail, instead of expected pass during final stage
ERROR - The check after remediation failed for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions'.
INFO - Script IncludeConfig_perms_0601.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in fail, instead of expected pass during final stage
ERROR - The check after remediation failed for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions'.
INFO - Script include_perms_0600_IncludeConfig_perms_0601.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in fail, instead of expected pass during final stage
ERROR - The check after remediation failed for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions'.
INFO - Script IncludeConfig_glob_perms_0601.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in fail, instead of expected pass during final stage
ERROR - The check after remediation failed for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions'.
INFO - Script perms_0601.fail.sh using profile (all) OK
ERROR - Rule evaluation resulted in fail, instead of expected pass during final stage
ERROR - The check after remediation failed for rule 'xccdf_org.ssgproject.content_rule_rsyslog_files_permissions'.

[yuumasato]

@vojtapolasek test scenarios should be passing now. Thanks

[codeclimate]

Code Climate has analyzed commit 855ff16 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 42.7% (0.0% change).

View more on Code Climate.

[openshift-ci]

@yuumasato: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-rhcos4-high	855ff16	link	true	/test e2e-aws-rhcos4-high
ci/prow/e2e-aws-rhcos4-moderate	855ff16	link	true	/test e2e-aws-rhcos4-moderate

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[vojtapolasek]

Looks good now, thank you.