ANSSI profiles - ansible playbook run error

[mildas]

Description of problem:

Ansible playbook run is terminated by an error during the execution.

SCAP Security Guide Version:

48b6d26

Operating System Version:

RHEL 7.9, RHEL 8

Steps to Reproduce:

1. ansible-playbook --skip-tags ensure_gpgcheck_never_disabled,configure_opensc_nss_db --private-key=~/.ssh/id_ecdsa -i "192.168.122.148," /usr/share/scap-security-guide/ansible/rhel7-playbook-anssi_nt28_high.yml

Actual Results:

ansible-playbook fails

Expected Results:

ansible-playbook finishes successfully

Additional Information/Debugging Steps:

The termination is caused by this task:

TASK [Find all world writable files not owned by root on local partitions and change their owner to root] ***
fatal: [192.168.122.148]: FAILED! => {"changed": true, "cmd": "find / -not -fstype afs -not -fstype ceph -not -fstype cifs -not -fstype smb3 -not -fstype smbfs -not -fstype sshfs -not -fstype ncpfs -not -fstype ncp -not -fstype nfs -not -fstype nfs4 -not -fstype gfs -not -fstype gfs2 -not -fstype glusterfs -not -fstype gpfs -not -fstype pvfs2 -not -fstype ocfs2 -not -fstype lustre -not -fstype davfs -type d -perm -0002 -uid +0 -exec chown root {} \\;", "delta": "0:00:00.950458", "end": "2021-01-09 17:58:01.412296", "msg": "non-zero return code", "rc": 1, "start": "2021-01-09 17:58:00.461838", "stderr": "find: ‘/proc/sys/fs/binfmt_misc’: No such device", "stderr_lines": ["find: ‘/proc/sys/fs/binfmt_misc’: No such device"], "stdout": "", "stdout_lines": []}

[vojtapolasek]

After some investigation, I found out this:

• the rule which causes the playbook to fail is included in intermediary level of the profile.
• The Enhanced level of the profile includes this rule as well, but no playbook failure appeared.
• The problem happens only with the High level profile.
• The problem might be caused by selinux, but can't confirm this properly. The playbook finishes successfully if I:
  • remove the selinux_state rule from the profile
  • remove the sebool_ssh_sysadm_login rule from the profile
• When I use a playbok for Enhanced profile level and apply these potentially problematic rules manually (with Ansible playbooks for individual rules), the problem does not manifest

Any ideas?

[yuumasato]

This was fixed by #6558

[yuumasato]

And later improved by #6581