5.4.4 fails due to wrong umask and error

[shashank-singhal]

Ansible Version - 2.9.9

ISSUE

1. The umask variable centos7cis_default_user_umask changes to 023 instead of 027 when executing. (not sure if it my system specific issue)

CentOS7-CIS/tasks/section5.yml

Line 1228 in e1c3814

line: 'umask {{ centos7cis_default_user_umask }}'

CentOS7-CIS/tasks/section5.yml

Line 1243 in e1c3814

line: 'umask {{ centos7cis_default_user_umask }}'

2. The profiled_dir.files.path fails
   

   CentOS7-CIS/tasks/section5.yml

   Line 1275 in e1c3814

   with_items: profiled_dir.files.path

with error as given below

TASK [CentOS7-CIS : SCORED | 5.4.4 | PATCH | Ensure default user umask is 027 or more restrictive] *********************************************************************
failed: [localhost] (item=profiled_dir.files[0].path) => {"ansible_loop_var": "item", "changed": false, "item": "profiled_dir.files[0].path", "msg": "Destination profiled_dir.files.path does not exist !", "rc": 257}
...ignoring

Workaround for centos7cis_default_user_umask changing to 023, run the ansible playbook with variables as command line argument by adding below argument
--extra-vars "centos7cis_default_user_umask=027"
which will overpower the internal variable value.

Viewpoint
The structure of the profiled_dir.files is an array of dictionaries. Not sure how to get through this one using ansible at the moment.

[shashank-singhal]

I updated the centos7cis_default_user_umask in the main.yml to a string "027" and it picks 027 in the umask line.

[shashank-singhal]

Updated

CentOS7-CIS/tasks/section5.yml

Line 1275 in e1c3814

with_items: profiled_dir.files.path

to

 with_items:
  - "{{ profiled_dir.files }}"

and

CentOS7-CIS/tasks/section5.yml

Line 1271 in e1c3814

dest: "{{ item }}"

to
dest: "{{ item.path}}"

and now it works.

I am still learning ansible and was driven to the above refactoring by the errors provided by ansible. Please enlighten me if this change in syntax is due to the version I am using ansible 2.9.9

[radsec]

I will look into resolving the issue this evening.