Skip to content

Conversation

@jan-cerny
Copy link
Collaborator

@jan-cerny jan-cerny commented Jul 15, 2025

Description:

This PR changes some Ansible Tasks to work in check mode. The objective is to prevent premature terminations of Ansible Playbooks for our profiles.

The most frequent change is that some Ansible tasks that use the command or shell module will run also in check mode. This isn't done for all tasks using these modules but only for some of them that are read only and they check some status or read some files, usually the grep command.

For more details, please read commit messages of each commit.

Rationale:

Resolves: https://issues.redhat.com/browse/OPENSCAP-5480

Review Hints:

Run the contest test that will be introduced by PR RHSecurityCompliance/contest#424.

@jan-cerny jan-cerny added the Ansible Ansible remediation update. label Jul 15, 2025
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 15, 2025
@openshift-ci
Copy link

openshift-ci bot commented Jul 15, 2025

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

@jan-cerny jan-cerny added this to the 0.1.78 milestone Jul 15, 2025
@Mab879 Mab879 self-assigned this Jul 15, 2025
@openshift-merge-robot openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jul 16, 2025
jan-cerny added 14 commits July 16, 2025 09:09
Prevents failure if the file "pam_file_path" doesn't exist.
Notice that "pam_file_path" is a variable with sometimes
a different value than "pam_file" constant, therefore we can't
reuse the already existing ansible.builtin.stat task above.
If authselect isn't enabled, the playbook would terminate here.
In normal mode it makes sense because subsequent tasks depend on
authselect and use the authselect command. But, in check mode,
it isn't possible to enable authselect, so we need to skip this check.
Tasks using shell or command module normally don't run in check mode.
Setting the check_mode attribute to false on a task using shell or command module
will cause that this task will be executed also in check mode.
This can't be done on all these tasks but only on tasks that don't
perform any change to the system but they just read a value or
read a status of something (for example grep commands).
Check that the file modified in the tasks exists before starting
the tasks to prevent errors "no such file".
Prevent executing tasks depending on authselect profile
if authselect profile hasn't been created.
Prevent playbook termination in check mode if aide hasn't been
installed.
Prevent fails in check mode caused by attempts to modify nonexistent
files. Make sure AIDE is installed before trying to modify AIDE
configuration files.
Prevent fails in check mode caused by attempts to modify nonexistent
files. Make sure fapolicyd is installed before trying to modify fapolicyd
configuration files.
The task fail is check mode because the /etc/cron.daily/logrotate
doesn't exist. This fail can happen only in check mode because in the
normal run the file is created in the task right before.
This prevents errors in check mode. In normal mode it doesn't
have an effect because the file is created by the previous task above.
If the file doesn't exists it fails with "No such file or directory: b'gpg'"
Prevents termination in check mode if the service doesn't run
because a playbook in check mode doesn't start services, it only
checks
@jan-cerny jan-cerny force-pushed the ansible_check_mode branch from d7caaae to 1f9312a Compare July 16, 2025 07:11
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jul 16, 2025
@jan-cerny jan-cerny marked this pull request as ready for review July 16, 2025 09:14
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 16, 2025
@Mab879 Mab879 merged commit d382f7b into ComplianceAsCode:master Jul 17, 2025
126 of 129 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Ansible Ansible remediation update.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants