Updating macros to support idempotency when deduplicating values

[carlosmmatos]

Description:

• Current ansible lineinfile macros do not support idempotent behavior when invoking the ansible_only_lineinfile macro.

Rationale:

• If we're using Ansible, might as well use it better. Ensure that the rules that use these macros provide the end-user with a better Ansible experience.

[openscap-ci]

Changes identified:
Rules:
 sshd_allow_only_protocol2
 sshd_use_priv_separation
 sshd_rekey_limit
 sshd_use_approved_macs
 selinux_state
 coredump_disable_backtraces
 accounts_tmout
 coredump_disable_storage
 sshd_set_idle_timeout
 accounts_have_homedir_login_defs
 sshd_use_approved_ciphers
 sshd_set_max_sessions
 configure_openssl_tls_crypto_policy
 selinux_policytype
 configure_tmux_lock_after_time
 sshd_disable_rhosts_rsa
 sshd_disable_compression
 sshd_set_keepalive
 sshd_set_max_auth_tries
 configure_tmux_lock_command
Macros:
 ansible_lineinfile
 ansible_only_lineinfile

Show details

Rule sshd_allow_only_protocol2:
 Ansible remediation changed.
Rule sshd_use_priv_separation:
 Ansible remediation changed.
Rule sshd_rekey_limit:
 Ansible remediation changed.
Rule sshd_use_approved_macs:
 Ansible remediation changed.
Rule selinux_state:
 Ansible remediation changed.
Rule coredump_disable_backtraces:
 Ansible remediation changed.
Rule accounts_tmout:
 Ansible remediation changed.
Rule coredump_disable_storage:
 Ansible remediation changed.
Rule sshd_set_idle_timeout:
 Ansible remediation changed.
Rule accounts_have_homedir_login_defs:
 Ansible remediation changed.
Rule sshd_use_approved_ciphers:
 Ansible remediation changed.
Rule sshd_set_max_sessions:
 Ansible remediation changed.
Rule configure_openssl_tls_crypto_policy:
 Ansible remediation changed.
Rule selinux_policytype:
 Ansible remediation changed.
Rule configure_tmux_lock_after_time:
 Ansible remediation changed.
Rule sshd_disable_rhosts_rsa:
 Ansible remediation changed.
Rule sshd_disable_compression:
 Ansible remediation changed.
Rule sshd_set_keepalive:
 Ansible remediation changed.
Rule sshd_set_max_auth_tries:
 Ansible remediation changed.
Rule configure_tmux_lock_command:
 Ansible remediation changed.
Macro ansible_lineinfile:
 In Ansible remediation for accounts_polyinstantiated_tmp.
 In Ansible remediation for sshd_allow_only_protocol2.
 In Ansible remediation for configure_tmux_lock_after_time.
 In Ansible remediation for sshd_rekey_limit.
 In Ansible remediation for configure_openssl_tls_crypto_policy.
 In Ansible remediation for sshd_set_max_sessions.
 In Ansible remediation for file_permissions_local_var_log_messages.
 In Ansible remediation for sshd_use_approved_macs.
 In Ansible remediation for configure_tmux_lock_command.
 In Ansible remediation for sshd_set_max_auth_tries.
 In Ansible remediation for sshd_set_idle_timeout.
 In Ansible remediation for sshd_disable_rhosts_rsa.
 In Ansible remediation for enable_pam_namespace.
 In Ansible remediation for sshd_disable_compression.
 In Ansible remediation for accounts_have_homedir_login_defs.
 In Ansible remediation for selinux_state.
 In Ansible remediation for accounts_polyinstantiated_var_tmp.
 In Ansible remediation for sshd_use_approved_ciphers.
 In Ansible remediation for accounts_tmout.
 In Ansible remediation for sudoers_validate_passwd.
 In Ansible remediation for ntpd_configure_restrictions.
 In Ansible remediation for selinux_policytype.
 In Ansible remediation for coredump_disable_storage.
 In Ansible remediation for sshd_set_keepalive.
 In Ansible remediation for postfix_network_listening_disabled.
 In Ansible remediation for ssh_client_rekey_limit.
 In Ansible remediation for sshd_use_priv_separation.
 In Ansible remediation for coredump_disable_backtraces.
Macro ansible_only_lineinfile:
 In Ansible remediation for sshd_allow_only_protocol2.
 In Ansible remediation for configure_tmux_lock_after_time.
 In Ansible remediation for sshd_rekey_limit.
 In Ansible remediation for configure_openssl_tls_crypto_policy.
 In Ansible remediation for sshd_set_max_sessions.
 In Ansible remediation for sshd_use_approved_macs.
 In Ansible remediation for configure_tmux_lock_command.
 In Ansible remediation for sshd_set_max_auth_tries.
 In Ansible remediation for sshd_set_idle_timeout.
 In Ansible remediation for sshd_disable_rhosts_rsa.
 In Ansible remediation for sshd_disable_compression.
 In Ansible remediation for accounts_have_homedir_login_defs.
 In Ansible remediation for selinux_state.
 In Ansible remediation for sshd_use_approved_ciphers.
 In Ansible remediation for accounts_tmout.
 In Ansible remediation for selinux_policytype.
 In Ansible remediation for coredump_disable_storage.
 In Ansible remediation for sshd_set_keepalive.
 In Ansible remediation for sshd_use_priv_separation.
 In Ansible remediation for coredump_disable_backtraces.

Recommended tests to execute:
 build_product rhel7
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel7-ds.xml sshd_use_priv_separation
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel7-ds.xml sshd_use_approved_macs
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel7-ds.xml sshd_use_approved_ciphers
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel7-ds.xml sshd_disable_rhosts_rsa
 build_product rhel8
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml sshd_allow_only_protocol2
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml sshd_rekey_limit
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml selinux_state
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml coredump_disable_backtraces
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml accounts_tmout
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml coredump_disable_storage
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml sshd_set_idle_timeout
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml accounts_have_homedir_login_defs
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml sshd_set_max_sessions
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml configure_openssl_tls_crypto_policy
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml selinux_policytype
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml configure_tmux_lock_after_time
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml sshd_disable_compression
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml sshd_set_max_auth_tries
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-rhel8-ds.xml configure_tmux_lock_command
 build_product fedora
 tests/test_suite.py rule --libvirt qemu:///system test-suite-vm --remediate-using ansible --datastream build/ssg-fedora-ds.xml sshd_set_keepalive

[jan-cerny]

The change looks fine but we need some test scenarios that test this macro. For example in rule accounts_tmout.

[carlosmmatos]

The change looks fine but we need some test scenarios that test this macro. For example in rule accounts_tmout.

Sounds good.. I'll look into adding these this morning.

[jan-cerny]

/retest