Ansible tasks failing due to error controls changes

[marcusburghardt]

Description of problem:

The #10348 PR changed some Ansible tasks which were intentionally configured to ignore errors (ignore_errors: yes) to some criterion using failed_when: parameter.

This resulted in fatal errors when executing Ansible Playbooks for profiles and compromised the Ansible remediation.

SCAP Security Guide Version:

master branch as of 2023-04-01

Operating System Version:

RHEL7 and RHEL8

Steps to Reproduce:

1. ./build_product rhel8
2. ansible-playbook -i "TEST_VM_IP," build/ansible/rhel8-playbook-ospp.yml

OBS.: Also happening with other profiles.

Actual Results:

TASK [Limit Password Reuse - Check integrity of authselect current profile] ****
fatal: [localhost]: FAILED! => {"changed": false, "cmd": ["authselect", "check"], "delta": "0:00:00.003869", "end": "2023-04-01 05:17:03.931787", "failed_when_result": true, "msg": "non-zero return code", "rc": 2, "start": "2023-04-01 05:17:03.927918", "stderr": "", "stderr_lines": [], "stdout": "System was not configured with authselect.", "stdout_lines": ["System was not configured with authselect."]}

PLAY RECAP *********************************************************************
localhost                  : ok=43   changed=16   unreachable=0    failed=1    skipped=3    rescued=0    ignored=0  

Expected Results:

Ansible Playbook finishes without fatal errors

Additional Information/Debugging Steps:

Other tasks failing:

TASK [Test for id_provider different than Active Directory (ad)] ***************
fatal: [192.168.122.132]: FAILED! => {"changed": false, "cmd": ["grep", "-qzosP", "[[:space:]]*\\[domain\\/[^]]*]([^(\\n)]*(\\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$", "/etc/sssd/sssd.conf"], "delta": "0:00:00.007508", "end": "2023-04-01 09:45:46.107921", "failed_when_result": true, "msg": "non-zero return code", "rc": 2, "start": "2023-04-01 09:45:46.100413", "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}

PLAY RECAP *********************************************************************
192.168.122.132            : ok=1913 changed=338  unreachable=0    failed=1    skipped=916  rescued=1    ignored=0   

[marcusburghardt]

I reviewed the #10348 PR and identified the changes with possible impact to Ansible Playbooks stability. A fix was already proposed in #10427