Sle15 fix ansible cis remediations

[teacup-on-rockingchair]

Description:

• When run in check mode ansible remediation scripts should be more isolated and need extra checks instead of assumptions

Rationale:

• Fix ansible SLES cis remediations in check mode

• Drop service_timesyncd_configured from CIS SLE profile

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing
+++ xccdf_org.ssgproject.content_rule_accounts_password_set_warn_age_existing
@@ -29,7 +29,8 @@
     cmd: chage --warndays {{ var_accounts_password_warn_age_login_defs }} {{ item
       }}
   with_items: '{{ result_pass_warn_age_user_names.stdout_lines }}'
-  when: result_pass_warn_age_user_names.stdout_lines | length > 0
+  when: result_pass_warn_age_user_names is not skipped and result_pass_warn_age_user_names.stdout_lines
+    | length > 0
   tags:
   - CCE-86914-9
   - NIST-800-53-CM-6(a)

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing' differs.
--- xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing
+++ xccdf_org.ssgproject.content_rule_accounts_set_post_pw_existing
@@ -28,7 +28,7 @@
   ansible.builtin.command:
     cmd: chage --inactive {{ var_account_disable_post_pw_expiration }} {{ item }}
   with_items: '{{ user_names.stdout_lines }}'
-  when: user_names.stdout_lines | length > 0
+  when: user_names is not skipped and user_names.stdout_lines | length > 0
   tags:
   - CCE-86758-0
   - NIST-800-171-3.5.6

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_nftables_table' differs.
--- xccdf_org.ssgproject.content_rule_set_nftables_table
+++ xccdf_org.ssgproject.content_rule_set_nftables_table
@@ -38,6 +38,7 @@
     }}
   when:
   - '"nftables" in ansible_facts.packages'
+  - existing_nftables is not skipped
   - existing_nftables.stdout_lines | length == 0
   tags:
   - CCE-86162-5

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_efi_nosuid
@@ -58,6 +58,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/boot/efi" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-86038-7
@@ -102,6 +103,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/boot/efi" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_noauto' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_noauto
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_noauto
@@ -47,6 +47,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-83345-9
@@ -83,6 +84,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_nodev
@@ -59,6 +59,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82941-6
@@ -107,6 +108,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_noexec
@@ -47,6 +47,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-83316-0
@@ -83,6 +84,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_boot_nosuid
@@ -61,6 +61,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-81033-3
@@ -111,6 +112,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev
@@ -61,6 +61,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-80837-8
@@ -111,6 +112,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" |
     length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec
@@ -62,6 +62,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-80838-6
@@ -112,6 +113,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" |
     length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid
@@ -62,6 +62,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-80839-4
@@ -112,6 +113,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" |
     length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_grpquota' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_grpquota
+++ xccdf_org.ssgproject.content_rule_mount_option_home_grpquota
@@ -52,6 +52,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-86039-5
@@ -92,6 +93,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_home_nodev
@@ -50,6 +50,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-81048-1
@@ -88,6 +89,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_home_noexec
@@ -51,6 +51,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-83328-5
@@ -91,6 +92,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_home_nosuid
@@ -64,6 +64,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-81050-7
@@ -116,6 +117,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_home_usrquota' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_home_usrquota
+++ xccdf_org.ssgproject.content_rule_mount_option_home_usrquota
@@ -52,6 +52,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-86035-3
@@ -92,6 +93,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/home" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_opt_nosuid
@@ -50,6 +50,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/opt" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-83319-4
@@ -88,6 +89,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/opt" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid
+++ xccdf_org.ssgproject.content_rule_mount_option_proc_hidepid
@@ -53,6 +53,7 @@
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
   - ("" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-85882-9
@@ -89,6 +90,7 @@
     fstype: '{{ mount_info.fstype }}'
   when:
   - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("" |
     length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_srv_nosuid
@@ -50,6 +50,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/srv" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-83322-8
@@ -88,6 +89,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/srv" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_tmp_nodev
@@ -64,6 +64,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/tmp" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82623-0
@@ -115,6 +116,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/tmp" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_tmp_noexec
@@ -64,6 +64,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/tmp" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82139-7
@@ -116,6 +117,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/tmp" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_tmp_nosuid
@@ -64,6 +64,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/tmp" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82140-5
@@ -116,6 +117,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/tmp" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev
@@ -66,6 +66,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log/audit" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82080-3
@@ -119,6 +120,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log/audit" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec
@@ -66,6 +66,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log/audit" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82975-4
@@ -119,6 +120,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log/audit" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid
@@ -66,6 +66,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log/audit" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82921-8
@@ -119,6 +120,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log/audit" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev
@@ -65,6 +65,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82077-9
@@ -117,6 +118,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec
@@ -66,6 +66,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82008-4
@@ -118,6 +119,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid
@@ -66,6 +66,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82065-4
@@ -118,6 +119,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/log" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_nodev
@@ -62,6 +62,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82062-1
@@ -111,6 +112,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_noexec
@@ -50,6 +50,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-83330-1
@@ -88,6 +89,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_nosuid
@@ -50,6 +50,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-83383-0
@@ -88,6 +89,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev
+++ xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nodev
@@ -53,6 +53,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/tmp" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82068-8
@@ -93,6 +94,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/tmp" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec
+++ xccdf_org.ssgproject.content_rule_mount_option_var_tmp_noexec
@@ -54,6 +54,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/tmp" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82151-2
@@ -94,6 +95,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/tmp" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid' differs.
--- xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
+++ xccdf_org.ssgproject.content_rule_mount_option_var_tmp_nosuid
@@ -54,6 +54,7 @@
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/tmp" in ansible_mounts | map(attribute="mount") | list )
   - ("--fstab" | length == 0)
+  - device_name.stdout is defined and device_name.stdout_lines is defined
   - (device_name.stdout | length == 0)
   tags:
   - CCE-82154-6
@@ -94,6 +95,7 @@
   when:
   - ( ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
     and "/var/tmp" in ansible_mounts | map(attribute="mount") | list )
+  - mount_info is defined
   - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
     | length == 0)
   tags:

[jan-cerny]

In the GitHub CI in Automatus's test run on SLE15 there seems to be some problem with test scenarios of rule all_apparmor_profiles_enforced.

Looking at the prescripts logs, there are fail like for example:

incorrect_apparmor_profiles.fail.sh: line 4: aa-teardown: command not found

What do you think about it?

[codeclimate]

Code Climate has analyzed commit 3a5d26a and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 58.5%.

View more on Code Climate.

[teacup-on-rockingchair]

In the GitHub CI in Automatus's test run on SLE15 there seems to be some problem with test scenarios of rule all_apparmor_profiles_enforced.

Looking at the prescripts logs, there are fail like for example:

incorrect_apparmor_profiles.fail.sh: line 4: aa-teardown: command not found

What do you think about it?
I did spend some time trying to overcome this but failed for now.

The immediate problem there is the installation of required packages, which is fixable by adding the packages requirements for the failing and similar apparmor tests.

In general the tests there would require a container with apparmor enabled, with systemd service, the proper file system and to be honest tried to fixed it by mocking the file system structure but still it fails because of some syscalls failing I believe

[jan-cerny]

/packit retest-failed

[jan-cerny]

/packit retest-failed

[teacup-on-rockingchair]

Hey @jan-cerny can you please merge this one, since it is now pending on someone from the SUSE-maintainers group but for now I am the only member of the group and cannot do much about it :)