Improve the arguments for Ansible command module #9921

marcusburghardt · 2022-12-02T13:08:08Z

Description:

It was used the awk command in a task and the delimiter character was :.
This was not quoted and making it prone to be interpreted as a module parameter.
This has likely been worked around in the past, but not in the most compatible way, causing the Playbook a fatal error on some systems with different versions of Ansible. Relevant tasks have been improved to be more robust and compatible.

Rationale:

Avoid fatal errors on Ansible Playbooks

It was used the awk command in a task and the delimiter character was ":". This has likely been worked around in the past, but not in the most compatible way, causing the Playbook a fatal error on some systems with different versions of Ansible. Relevant tasks have been improved to be more robust and compatible.

github-actions · 2022-12-02T13:09:36Z

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2022-12-02T13:12:01Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing
@@ -5,8 +5,9 @@
 - always
 
 - name: Collect users with not correct maximum time period between password changes
- ansible.builtin.command: |
- awk -F: '$5 > {{ var_accounts_maximum_age_login_defs }} || $5 == "" {print $1}' /etc/shadow
+ ansible.builtin.command:
+ cmd: awk -F':' '$5 > {{ var_accounts_maximum_age_login_defs }} || $5 == "" {print
+ $1}' /etc/shadow
 register: user_names
 tags:
 - CCE-82473-0

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chgrp 0 /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/grub.cfg
 register: file_exists
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80800-6
@@ -42,8 +42,8 @@
 path: /boot/grub2/grub.cfg
 group: '0'
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chgrp 0 /boot/grub2/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/user.cfg
 register: file_exists
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86009-8
@@ -42,8 +42,8 @@
 path: /boot/grub2/user.cfg
 group: '0'
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chown 0 /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/grub.cfg
 register: file_exists
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80805-5
@@ -42,8 +42,8 @@
 path: /boot/grub2/grub.cfg
 owner: '0'
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chown 0 /boot/grub2/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_user_cfg
@@ -20,8 +20,8 @@
 path: /boot/grub2/user.cfg
 register: file_exists
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86015-5
@@ -42,8 +42,8 @@
 path: /boot/grub2/user.cfg
 owner: '0'
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chmod u-xs,g-xwrs,o-xwrt /boot/grub2/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_grub2_cfg
@@ -18,8 +18,8 @@
 path: /boot/grub2/grub.cfg
 register: file_exists
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-80814-7
@@ -38,8 +38,8 @@
 path: /boot/grub2/grub.cfg
 mode: u-xs,g-xwrs,o-xwrt
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if rpm --quiet -q grub2-common && [ ! -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if [ ! -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chmod u-xs,g-xwrs,o-xwrt /boot/grub2/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_user_cfg
@@ -18,8 +18,8 @@
 path: /boot/grub2/user.cfg
 register: file_exists
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86024-7
@@ -38,8 +38,8 @@
 path: /boot/grub2/user.cfg
 mode: u-xs,g-xwrs,o-xwrt
 when:
+ - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - '"grub2-common" in ansible_facts.packages'
- - '"/boot/efi" not in ansible_mounts | map(attribute="mount") | list'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chgrp 0 /boot/efi/EFI/redhat/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_efi_grub2_cfg
@@ -20,8 +20,8 @@
 path: /boot/efi/EFI/redhat/grub.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-85915-7
@@ -42,8 +42,8 @@
 path: /boot/efi/EFI/redhat/grub.cfg
 group: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chgrp 0 /boot/efi/EFI/redhat/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_groupowner_efi_user_cfg
@@ -20,8 +20,8 @@
 path: /boot/efi/EFI/redhat/user.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86012-2
@@ -42,8 +42,8 @@
 path: /boot/efi/EFI/redhat/user.cfg
 group: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chown 0 /boot/efi/EFI/redhat/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_efi_grub2_cfg
@@ -20,8 +20,8 @@
 path: /boot/efi/EFI/redhat/grub.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-85913-2
@@ -42,8 +42,8 @@
 path: /boot/efi/EFI/redhat/grub.cfg
 owner: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chown 0 /boot/efi/EFI/redhat/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_owner_efi_user_cfg
@@ -20,8 +20,8 @@
 path: /boot/efi/EFI/redhat/user.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86021-3
@@ -42,8 +42,8 @@
 path: /boot/efi/EFI/redhat/user.cfg
 owner: '0'
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chmod u-s,g-xwrs,o-xwrt /boot/efi/EFI/redhat/grub.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_efi_grub2_cfg
@@ -18,8 +18,8 @@
 path: /boot/efi/EFI/redhat/grub.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-85912-4
@@ -38,8 +38,8 @@
 path: /boot/efi/EFI/redhat/grub.cfg
 mode: u-s,g-xwrs,o-xwrt
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ -f /sys/firmware/efi ] && rpm --quiet -q grub2-common && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
+if rpm --quiet -q grub2-common && [ -f /sys/firmware/efi ] && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
 
 chmod u-xs,g-xwrs,o-xwrt /boot/efi/EFI/redhat/user.cfg
 

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg' differs.
--- xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg
+++ xccdf_org.ssgproject.content_rule_file_permissions_efi_user_cfg
@@ -18,8 +18,8 @@
 path: /boot/efi/EFI/redhat/user.cfg
 register: file_exists
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 tags:
 - CCE-86028-8
@@ -38,8 +38,8 @@
 path: /boot/efi/EFI/redhat/user.cfg
 mode: u-xs,g-xwrs,o-xwrt
 when:
+ - '"grub2-common" in ansible_facts.packages'
 - '"/boot/efi" in ansible_mounts | map(attribute="mount") | list'
- - '"grub2-common" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
 - file_exists.stat is defined and file_exists.stat.exists
 tags:

bash remediation for rule 'xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay' differs.
--- xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay
+++ xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay
@@ -1,5 +1,5 @@
 # Remediation is applicable only in certain platforms
-if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q postfix; then
+if rpm --quiet -q postfix && [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
 
 if ! grep -q ^smtpd_client_restrictions /etc/postfix/main.cf; then
 echo "smtpd_client_restrictions = permit_mynetworks,reject" >> /etc/postfix/main.cf

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay' differs.
--- xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay
+++ xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay
@@ -40,8 +40,8 @@
 line: smtpd_client_restrictions = permit_mynetworks,reject
 state: present
 when:
+ - '"postfix" in ansible_facts.packages'
 - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
- - '"postfix" in ansible_facts.packages'
 tags:
 - CCE-84054-6
 - DISA-STIG-RHEL-08-040290

codeclimate · 2022-12-02T13:55:21Z

Code Climate has analyzed commit a26be8a and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 48.8% (0.0% change).

View more on Code Climate.

jan-cerny · 2022-12-02T16:02:08Z

please link the productization issue

marcusburghardt · 2022-12-08T10:50:41Z

please link the productization issue

Honza, this issue was only visible in ppc64 when executing the /usr/share/scap-security-guide/ansible/rhel7-playbook-stig.yml playbook.

The error was:

ERROR! this task 'ansible.builtin.command' has extra params, which is only allowed in the following modules: shell, win_shell, include_vars, add_host, raw, include_role, meta, set_fact, include, import_tasks, script, import_role, include_tasks, group_by, command, win_command

The error appears to be in '/usr/share/scap-security-guide/ansible/rhel7-playbook-stig.yml': line 8591, column 7, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:


    - name: Collect users with not correct maximum time period between password changes
      ^ here

So, it happens only in a very specific case and was pretty easy to be fixed. Therefore, I sent this PR directly.
It seems the syntax ansible.builtin.command: > is not enough in some cases.

dodys · 2022-12-15T19:20:44Z

@marcusburghardt fyi, this might be also an issue for accounts_password_set_min_life_existing

marcusburghardt added Ansible Ansible remediation update. productization-issue Issue found in upstream stabilization process. labels Dec 2, 2022

marcusburghardt added this to the 0.1.66 milestone Dec 2, 2022

marcusburghardt force-pushed the ansible_command_improvement branch from 47d1e40 to a26be8a Compare December 2, 2022 13:08

marcusburghardt requested a review from jan-cerny December 14, 2022 09:09

jan-cerny self-assigned this Dec 15, 2022

jan-cerny approved these changes Dec 15, 2022

View reviewed changes

jan-cerny merged commit 147c6c6 into ComplianceAsCode:master Dec 15, 2022

marcusburghardt deleted the ansible_command_improvement branch December 15, 2022 14:28

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Improve the arguments for Ansible command module #9921

Improve the arguments for Ansible command module #9921

marcusburghardt commented Dec 2, 2022

github-actions bot commented Dec 2, 2022

github-actions bot commented Dec 2, 2022 •

edited

Loading

codeclimate bot commented Dec 2, 2022

jan-cerny commented Dec 2, 2022

marcusburghardt commented Dec 8, 2022

dodys commented Dec 15, 2022

Improve the arguments for Ansible command module #9921

Improve the arguments for Ansible command module #9921

Conversation

marcusburghardt commented Dec 2, 2022

Description:

Rationale:

github-actions bot commented Dec 2, 2022

github-actions bot commented Dec 2, 2022 • edited Loading

codeclimate bot commented Dec 2, 2022

jan-cerny commented Dec 2, 2022

marcusburghardt commented Dec 8, 2022

dodys commented Dec 15, 2022

github-actions bot commented Dec 2, 2022 •

edited

Loading