ssh_hardening: Install selinux dependencies fails on Oracle Linux (RHEL) 9

[robpomeroy]

Describe the bug

Task devsec.hardening.ssh_hardening : Install selinux dependencies when selinux is installed fails with the following message:

No package policycoreutils-python available.

I think this is because the package under OL9 is named policycoreutils-python-utils and the role does not distinguish Oracle Linux (as it does CentOS).

Expected behavior

Play installs correct package and proceeds.

Actual behavior

Play halts.

Example Playbook

Snippet:

    - role: devsec.hardening.ssh_hardening
      vars:
        sftp_enabled: true # maintain SFTP support for Ansible
        sftp_chroot: false

OS / Environment

Oracle Linux 9.0 (derived from Red Hat Enterprise Linux 9).

Ansible Version

[DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the controller starting with Ansible 2.12. Current version: 3.6.8 (default, May 19 2021, 10:00:09) [GCC 8.4.1 20200928 (Red Hat 8.4.1-1.0.1)]. This feature will be removed from ansible-core in version
 2.12. Deprecation warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
ansible [core 2.11.4] 
  config file = /home/rob/personal/Ansible/App-server/ansible.cfg
  configured module search path = ['/home/rob/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.6/site-packages/ansible
  ansible collection location = /home/rob/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible
  python version = 3.6.8 (default, May 19 2021, 10:00:09) [GCC 8.4.1 20200928 (Red Hat 8.4.1-1.0.1)]
  jinja version = 3.0.1
  libyaml = True

Role Version

8.2.0

Note

A workaround (which I've applied locally) would be to copy vars/CentOS_9.yml as vars/OracleLinux_9.yml. Not very DRY though.

[rndmh3ro]

Thanks for noticing!

I actually already have a fix implemented in this branch: https://github.com/dev-sec/ansible-collection-hardening/tree/support_more_os/roles/ssh_hardening/vars

Since the changes in this branch are not complete yet, I didn't merge it yet.

[robpomeroy]

Excellent, thanks Sebastian. I guess it's not just OL9 that's affected. 👍

[schurzi]

this should be fixed by #588