Question: where to report problems with generated ansible playbooks?

[hhenkel]

Description of problem:

We are trying to use https://github.com/RedHatOfficial/ansible-rhel7-ospp-role for the hardening of our systems but see hat least three issues with the role as it is currently. My understanding is, that the linked role is generated with the stuff that lives here.

Therefore the question arises where we should create the issues for the role - here in this repo, in the role repo or via support.redhat.com ?

[redhatrises]

@hhenkel what are the issues that you are seeing? We have various fixes submitted in PRs right now that may or may not fix your issues.

[hhenkel]

@redhatrises we had to change the behavior for the tasks after get back device associated to mountpoint as this could return an empty string.

-   check_mode: false
    name: get back device associated to mountpoint
    register: device_name
    shell: mount | grep ' {{ var_removable_partition }} ' |cut -d ' ' -f 1
    tags:
    - mount_option_nosuid_removable_partitions
    - unknown_severity
    - configure_strategy
    - low_complexity
    - high_disruption
    - CCE-80148-0
    - NIST-800-53-AC-6
    - NIST-800-53-AC-19(a)
    - NIST-800-53-AC-19(d)
    - NIST-800-53-AC-19(e)
    - NIST-800-53-CM-7
    - NIST-800-53-MP-2
    - DISA-STIG-RHEL-07-021010
-   check_mode: false
    name: get back device previous mount option
    register: device_cur_mountoption
    shell: mount | grep ' {{ var_removable_partition }} ' | sed -re 's:.*\((.*)\):\1:'
    tags:
    - mount_option_nosuid_removable_partitions
    - unknown_severity
    - configure_strategy
    - low_complexity
    - high_disruption
    - CCE-80148-0
    - NIST-800-53-AC-6
    - NIST-800-53-AC-19(a)
    - NIST-800-53-AC-19(d)
    - NIST-800-53-AC-19(e)
    - NIST-800-53-CM-7
    - NIST-800-53-MP-2
    - DISA-STIG-RHEL-07-021010
    when: device_name.stdout | length > 0

We also saw an issue here with empty lines:

@@ -8506,7 +8515,7 @@
     failed_when: false
     name: Read list of files with incorrect permissions
     register: files_with_incorrect_permissions
-    shell: rpm -Va | grep '^.M' | cut -d ' ' -f5- | sed -r 's;^.*\s+(.+);\1;g'
+    shell: rpm -Va | grep '^.M' | cut -d ' ' -f5- | sed -r 's;^.*\s+(.+);\1;g' | sed '/^\s*$/d'
     tags:
     - rpm_verify_permissions
     - high_severity

The required runtime of the role would really benefit from a sane way of checking the sebool stuff as it is really unnecessary to check if the package is installed every time:

$ grep "Ensure libsemanage-python installed" tasks/main.yml  | wc -l
61

[redhatrises]

@redhatrises we had to change the behavior for the tasks after get back device associated to mountpoint as this could return an empty string.

-   check_mode: false
    name: get back device associated to mountpoint
    register: device_name
    shell: mount | grep ' {{ var_removable_partition }} ' |cut -d ' ' -f 1
    tags:
    - mount_option_nosuid_removable_partitions
    - unknown_severity
    - configure_strategy
    - low_complexity
    - high_disruption
    - CCE-80148-0
    - NIST-800-53-AC-6
    - NIST-800-53-AC-19(a)
    - NIST-800-53-AC-19(d)
    - NIST-800-53-AC-19(e)
    - NIST-800-53-CM-7
    - NIST-800-53-MP-2
    - DISA-STIG-RHEL-07-021010
-   check_mode: false
    name: get back device previous mount option
    register: device_cur_mountoption
    shell: mount | grep ' {{ var_removable_partition }} ' | sed -re 's:.*\((.*)\):\1:'
    tags:
    - mount_option_nosuid_removable_partitions
    - unknown_severity
    - configure_strategy
    - low_complexity
    - high_disruption
    - CCE-80148-0
    - NIST-800-53-AC-6
    - NIST-800-53-AC-19(a)
    - NIST-800-53-AC-19(d)
    - NIST-800-53-AC-19(e)
    - NIST-800-53-CM-7
    - NIST-800-53-MP-2
    - DISA-STIG-RHEL-07-021010
    when: device_name.stdout | length > 0

If you can provide a fix for the above issues, PRs welcome.

We also saw an issue here with empty lines:

@@ -8506,7 +8515,7 @@
     failed_when: false
     name: Read list of files with incorrect permissions
     register: files_with_incorrect_permissions
-    shell: rpm -Va | grep '^.M' | cut -d ' ' -f5- | sed -r 's;^.*\s+(.+);\1;g'
+    shell: rpm -Va | grep '^.M' | cut -d ' ' -f5- | sed -r 's;^.*\s+(.+);\1;g' | sed '/^\s*$/d'
     tags:
     - rpm_verify_permissions
     - high_severity

There is already a PR submitted for a fix for this. Check out #3328

The required runtime of the role would really benefit from a sane way of checking the sebool stuff as it is really unnecessary to check if the package is installed every time:

$ grep "Ensure libsemanage-python installed" tasks/main.yml  | wc -l
61

This is a unique issue to solve because the playbook is generated by a bunch of small ansible script files. In addition, the playbook can be tailored to add/remove a check or rule.

[redhatrises]

Fix was merged, closing.