-
Notifications
You must be signed in to change notification settings - Fork 765
Prevent fails in check mode #13703
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Mab879
merged 14 commits into
ComplianceAsCode:master
from
jan-cerny:ansible_check_mode
Jul 17, 2025
Merged
Prevent fails in check mode #13703
Mab879
merged 14 commits into
ComplianceAsCode:master
from
jan-cerny:ansible_check_mode
Jul 17, 2025
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Skipping CI for Draft Pull Request. |
Prevents failure if the file "pam_file_path" doesn't exist. Notice that "pam_file_path" is a variable with sometimes a different value than "pam_file" constant, therefore we can't reuse the already existing ansible.builtin.stat task above.
If authselect isn't enabled, the playbook would terminate here. In normal mode it makes sense because subsequent tasks depend on authselect and use the authselect command. But, in check mode, it isn't possible to enable authselect, so we need to skip this check.
Tasks using shell or command module normally don't run in check mode. Setting the check_mode attribute to false on a task using shell or command module will cause that this task will be executed also in check mode. This can't be done on all these tasks but only on tasks that don't perform any change to the system but they just read a value or read a status of something (for example grep commands).
Check that the file modified in the tasks exists before starting the tasks to prevent errors "no such file".
Prevent executing tasks depending on authselect profile if authselect profile hasn't been created.
Prevent playbook termination in check mode if aide hasn't been installed.
Prevent fails in check mode caused by attempts to modify nonexistent files. Make sure AIDE is installed before trying to modify AIDE configuration files.
Prevent fails in check mode caused by attempts to modify nonexistent files. Make sure fapolicyd is installed before trying to modify fapolicyd configuration files.
The task fail is check mode because the /etc/cron.daily/logrotate doesn't exist. This fail can happen only in check mode because in the normal run the file is created in the task right before.
This prevents errors in check mode. In normal mode it doesn't have an effect because the file is created by the previous task above.
If the file doesn't exists it fails with "No such file or directory: b'gpg'"
Prevents termination in check mode if the service doesn't run because a playbook in check mode doesn't start services, it only checks
d7caaae to
1f9312a
Compare
Mab879
approved these changes
Jul 17, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
This PR changes some Ansible Tasks to work in check mode. The objective is to prevent premature terminations of Ansible Playbooks for our profiles.
The most frequent change is that some Ansible tasks that use the command or shell module will run also in check mode. This isn't done for all tasks using these modules but only for some of them that are read only and they check some status or read some files, usually the grep command.
For more details, please read commit messages of each commit.
Rationale:
Resolves: https://issues.redhat.com/browse/OPENSCAP-5480
Review Hints:
Run the contest test that will be introduced by PR RHSecurityCompliance/contest#424.