Refactored the when statement layout

Signed-off-by: Marco V <[email protected]>
ansible-lockdown · Jul 21, 2023 · 0e6c7df · 0e6c7df
1 parent 3bb8811
commit 0e6c7df
Showing 1 changed file with 22 additions and 6 deletions.
diff --git a/tasks/section_6/cis_6.1.x.yml b/tasks/section_6/cis_6.1.x.yml
@@ -158,13 +158,18 @@
         loop: "{{ ansible_mounts }}"
         loop_control:
             label: "{{ item.mount }}"
-        when: item['device'].startswith('/dev') and not 'bind' in item['options']
+        when:
+            - item['device'].startswith('/dev')
+            - not 'bind' in item['options']
 
       - name: "6.1.10 | AUDIT | Ensure no unowned files or directories exist | set fact"
         ansible.builtin.set_fact:
             rhel_09_6_1_10_unowned_files_found: true
         loop: "{{ rhel_09_6_1_10_audit.results }}"
-        when: item | length > 0 and item.stdout is defined and item.stdout | length > 0
+        when:
+            - item | length > 0
+            - item.stdout is defined # skipped items are part of results list, but don't have the registered module properties
+            - item.stdout | length > 0
 
       - name: "6.1.10 | AUDIT | Ensure no unowned files or directories exist | Displaying any unowned files or directories"
         ansible.builtin.debug:
@@ -199,13 +204,18 @@
         loop: "{{ ansible_mounts }}"
         loop_control:
             label: "{{ item.mount }}"
-        when: item['device'].startswith('/dev') and not 'bind' in item['options']
+        when:
+            - item['device'].startswith('/dev')
+            - not 'bind' in item['options']
 
       - name: "6.1.11 | AUDIT | Ensure no ungrouped files or directories exist | set fact"
         ansible.builtin.set_fact:
             rhel_09_6_1_11_ungrouped_files_found: true
         loop: "{{ rhel_09_6_1_11_audit.results }}"
-        when: item | length > 0 and item.stdout is defined and item.stdout | length > 0
+        when:
+            - item | length > 0
+            - item.stdout is defined # skipped items are part of results list, but don't have the registered module properties
+            - item.stdout | length > 0
 
       - name: "6.1.11 | AUDIT | Ensure no ungrouped files or directories exist | Displaying all ungrouped files or directories"
         ansible.builtin.debug:
@@ -258,7 +268,10 @@
         ansible.builtin.set_fact:
             rhel9_6_1_13_suid_found: true
         loop: "{{ rhel_09_6_1_13_suid_perms.results }}"
-        when: item | length > 0 and item.stdout is defined and item.stdout | length > 0
+        when:
+            - item | length > 0
+            - item.stdout is defined # skipped items are part of results list, but don't have the registered module properties
+            - item.stdout | length > 0
 
       - name: "6.1.13 | AUDIT | Audit SUID executables | Alert SUID executables exist"
         ansible.builtin.debug:
@@ -297,7 +310,10 @@
         ansible.builtin.set_fact:
             rhel9_6_1_14_sgid_found: true
         loop: "{{ rhel_09_6_1_14_sgid_perms.results }}"
-        when: item | length > 0 and item.stdout is defined and item.stdout | length > 0
+        when:
+            - item | length > 0
+            - item.stdout is defined # skipped items are part of results list, but don't have the registered module properties
+            - item.stdout | length > 0
 
       - name: "6.1.14 | AUDIT | Audit SGID executables | Alert SGID executables exist"
         ansible.builtin.debug: