Prevent Ansible Playbook termination in check mode

[jan-cerny]

Some Ansible Playbooks are terminating prematurely on some Ansible Tasks where the when statement assumes that a systemd service is installed. In normal mode, the installation is performed by other tasks, but in check mode, the installation isn't executed and the service isn't installed at the moment of checking the service state. This manifests in the test
/scanning/host-os/ansible-check/check-mode.

Addressing:

Configure Firewalld to Restrict Loopback Traffic - Ensure firewalld
trusted Zone Restricts IPv4 Loopback Traffic ({"msg": "The conditional
check 'ansible_facts.services['firewalld.service'].state == 'running''
failed. The error was: error while evaluating conditional
(ansible_facts.services['firewalld.service'].state == 'running'): 'dict
object' has no attribute 'firewalld.service'. 'dict object' has no
attribute 'firewalld.service'\n\nThe error appears to be in
'/usr/share/scap-security-guide/ansible/centos8-playbook-pci-dss.yml':
line 10070, column 7, but may\nbe elsewhere in the file depending on the
exact syntax problem.\n\nThe offending line appears to be:\n\n\n    -
name: Configure Firewalld to Restrict Loopback Traffic - Ensure
firewalld trusted\n      ^ here\n"})

Review Hints:

Check that the tests testing-farm:centos-stream-{8,9,10}-x86_64:contest-other pass.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted' differs.
--- xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted
+++ xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_restricted
@@ -79,7 +79,8 @@
       is changed
   when:
   - '"kernel-core" in ansible_facts.packages'
-  - ansible_facts.services['firewalld.service'].state == 'running'
+  - ('firewalld.service' in ansible_facts.services and ansible_facts.services['firewalld.service'].state
+    == 'running')
   tags:
   - CCE-87272-1
   - PCI-DSSv4-1.4
@@ -95,7 +96,8 @@
     on Service State
   ansible.builtin.assert:
     that:
-    - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
+    - (ansible_check_mode or ('firewalld.service' in ansible_facts.services and ansible_facts.services['firewalld.service'].state
+      == 'running'))
     fail_msg:
     - firewalld service is not active. Remediation aborted!
     - This remediation could not be applied because it depends on firewalld service

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted' differs.
--- xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted
+++ xccdf_org.ssgproject.content_rule_firewalld_loopback_traffic_trusted
@@ -67,7 +67,8 @@
     - result_lo_interface_assignment is changed
   when:
   - '"kernel-core" in ansible_facts.packages'
-  - ansible_facts.services['firewalld.service'].state == 'running'
+  - ('firewalld.service' in ansible_facts.services and ansible_facts.services['firewalld.service'].state
+    == 'running')
   tags:
   - CCE-87278-8
   - PCI-DSSv4-1.4
@@ -83,7 +84,8 @@
     on Service State
   ansible.builtin.assert:
     that:
-    - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
+    - (ansible_check_mode or ('firewalld.service' in ansible_facts.services and ansible_facts.services['firewalld.service'].state
+      == 'running'))
     fail_msg:
     - firewalld service is not active. Remediation aborted!
     - This remediation could not be applied because it depends on firewalld service

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_wireless_disable_interfaces' differs.
--- xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
+++ xccdf_org.ssgproject.content_rule_wireless_disable_interfaces
@@ -80,7 +80,8 @@
   - ( not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
     ) )
   - '''NetworkManager'' in ansible_facts.packages'
-  - ansible_facts.services['NetworkManager.service'].state == 'running'
+  - ('NetworkManager.service' in ansible_facts.services and ansible_facts.services['NetworkManager.service'].state
+    == 'running')
   tags:
   - CCE-83501-7
   - DISA-STIG-RHEL-08-040110

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled' differs.
--- xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled
+++ xccdf_org.ssgproject.content_rule_firewalld_sshd_port_enabled
@@ -111,8 +111,8 @@
     when:
     - result_nmcli_cmd_zone_assignment is defined
     - result_nmcli_cmd_zone_assignment is changed
-    - result_nmcli_cmd_zone_assignment.results | selectattr('changed', 'equalto',
-      true) | list | length > 0
+    - (result_nmcli_cmd_zone_assignment.results | selectattr('changed', 'equalto',
+      true) | list | length > 0)
 
   - name: Enable SSH Server firewalld Firewall Exception - Collect firewalld active
       zones
@@ -138,8 +138,10 @@
     - result_firewall_cmd_zones_names.stdout_lines | length > 0
   when:
   - '"kernel-core" in ansible_facts.packages'
-  - ansible_facts.services['firewalld.service'].state == 'running'
-  - ansible_facts.services['NetworkManager.service'].state == 'running'
+  - ('firewalld.service' in ansible_facts.services and ansible_facts.services['firewalld.service'].state
+    == 'running')
+  - ('NetworkManager.service' in ansible_facts.services and ansible_facts.services['NetworkManager.service'].state
+    == 'running')
   tags:
   - CCE-80820-4
   - NIST-800-171-3.1.12
@@ -158,13 +160,14 @@
     on services states
   ansible.builtin.assert:
     that:
-    - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
-    - ansible_check_mode or ansible_facts.services['NetworkManager.service'].state
-      == 'running'
+    - (ansible_check_mode or ('firewalld.service' in ansible_facts.services and ansible_facts.services['firewalld.service'].state
+      == 'running'))
+    - (ansible_check_mode or ('NetworkManager.service' in ansible_facts.services and
+      ansible_facts.services['NetworkManager.service'].state == 'running'))
     fail_msg:
     - firewalld and NetworkManager services are not active. Remediation aborted!
-    - This remediation could not be applied because it depends on firewalld and NetworkManager
-      services running.
+    - This remediation could not be applied because it depends on firewalld
+    - and NetworkManager services running.
     - The service is not started by this remediation in order to prevent connection
       issues.
     success_msg:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_suid_auid_privilege_function' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_suid_auid_privilege_function
+++ xccdf_org.ssgproject.content_rule_audit_rules_suid_auid_privilege_function
@@ -110,7 +110,8 @@
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
   - (augenrules_audit_rules_privilege_function_update_result.changed or auditctl_audit_rules_privilege_function_update_result.changed)
-  - ansible_facts.services["auditd.service"].state == "running"
+  - ("auditd.service" in ansible_facts.services and ansible_facts.services["auditd.service"].state
+    == "running")
   tags:
   - CCE-90209-8
   - audit_rules_suid_auid_privilege_function

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
+++ xccdf_org.ssgproject.content_rule_audit_rules_suid_privilege_function
@@ -146,7 +146,8 @@
   - '"audit" in ansible_facts.packages'
   - '"kernel-core" in ansible_facts.packages'
   - (augenrules_audit_rules_privilege_function_update_result.changed or auditctl_audit_rules_privilege_function_update_result.changed)
-  - ansible_facts.services["auditd.service"].state == "running"
+  - ("auditd.service" in ansible_facts.services and ansible_facts.services["auditd.service"].state
+    == "running")
   tags:
   - CCE-83556-1
   - DISA-STIG-RHEL-08-030000

[openshift-ci]

@jan-cerny: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	0c09bfa	link	true	/test e2e-aws-openshift-platform-compliance
ci/prow/e2e-aws-openshift-node-compliance	0c09bfa	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.