Merge pull request #13703 from jan-cerny/ansible_check_mode

Prevent fails in check mode

Author: Mab879

linux_os/guide/services/fapolicyd/fapolicy_default_deny/ansible/shared.yml

@@ -4,6 +4,10 @@
 # complexity = low
 # disruption = low
 
+- name: "{{{ rule_title }}} - Gather the package facts"
+  ansible.builtin.package_facts:
+    manager: auto
+
 - name: {{{ rule_title }}} - Ensure a Final Rule Denying Everything
   ansible.builtin.copy:
     content: |
@@ -15,6 +19,8 @@
     owner: root
     group: fapolicyd
     mode: '0644'
+  when:
+    - '"fapolicyd" in ansible_facts.packages'
   register: result_fapolicyd_final_rule
 
 - name: {{{ rule_title }}} - Ensure fapolicyd is Not Permissive
@@ -23,11 +29,14 @@
     regexp: '^(permissive\s*=).*$'
     line: '\1 0'
     backrefs: true
+  when:
+    - '"fapolicyd" in ansible_facts.packages'
   register: result_fapolicyd_enforced
 
 - name: "{{{ rule_title }}} - Restart fapolicyd If Permissive Mode or Final Rule is Changed"
   ansible.builtin.service:
     name: fapolicyd
     state: restarted
   when:
+    - '"fapolicyd" in ansible_facts.packages'
     - result_fapolicyd_final_rule is changed or result_fapolicyd_enforced is changed

linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/ansible/shared.yml

@@ -79,8 +79,8 @@
 - name: '{{{ rule_title }}} - Informative message based on services states'
   ansible.builtin.assert:
     that:
-      - ansible_facts.services['firewalld.service'].state == 'running'
-      - ansible_facts.services['NetworkManager.service'].state == 'running'
+      - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
+      - ansible_check_mode or ansible_facts.services['NetworkManager.service'].state == 'running'
     fail_msg:
       - firewalld and NetworkManager services are not active. Remediation aborted!
       - This remediation could not be applied because it depends on firewalld and NetworkManager services running.

linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_passwordauth/ansible/shared.yml

@@ -18,13 +18,19 @@
   block:
     {{{ ansible_ensure_pam_facts_and_authselect_profile(pam_file, rule_title=rule_title) | indent(4) }}}
 
-    - name: '{{{ rule_title }}} - Ensure That Only the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{{ pam_file }}}'
+    - name: '{{{ rule_title }}} - Check if "{{ pam_file_path }}" File is Present'
+      ansible.builtin.stat:
+        path: "{{ pam_file_path }}"
+      register: pam_file_path_present
+
+    - name: '{{{ rule_title }}} - Ensure That Only the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{ pam_file_path }}'
       ansible.builtin.replace:
         dest: "{{ pam_file_path }}"
         regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
         replace: '\1\2'
       when:
-        item != var_password_hashing_algorithm_pam
+        - item != var_password_hashing_algorithm_pam
+        - pam_file_path_present.stat.exists
       loop:
         - 'sha512'
         - 'yescrypt'

linux_os/guide/system/accounts/accounts-pam/set_password_hashing_algorithm/set_password_hashing_algorithm_systemauth/ansible/shared.yml

@@ -24,13 +24,19 @@
   block:
     {{{ ansible_ensure_pam_facts_and_authselect_profile(pam_file, rule_title=rule_title) | indent(4) }}}
 
-    - name: '{{{ rule_title }}} - Ensure That Only the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{{ pam_file }}}'
+    - name: '{{{ rule_title }}} - Check if "{{ pam_file_path }}" File is Present'
+      ansible.builtin.stat:
+        path: "{{ pam_file_path }}"
+      register: pam_file_path_present
+
+    - name: '{{{ rule_title }}} - Ensure That Only the Correct Hashing Algorithm Option For pam_unix.so Is Used in {{ pam_file_path }}'
       ansible.builtin.replace:
         dest: "{{ pam_file_path }}"
         regexp: (^\s*password.*pam_unix\.so.*)\b{{ item }}\b\s*(.*)
         replace: '\1\2'
       when:
-        item != var_password_hashing_algorithm_pam
+        - item != var_password_hashing_algorithm_pam
+        - pam_file_path_present.stat.exists
       loop:
         - 'sha512'
         - 'yescrypt'

linux_os/guide/system/logging/log_rotation/ensure_logrotate_activated/ansible/shared.yml

@@ -39,4 +39,5 @@
         path: "/etc/cron.daily/logrotate"
         line: '/usr/sbin/logrotate /etc/logrotate.conf'
         regexp: '^[\s]*/usr/sbin/logrotate[\s\S]*/etc/logrotate.conf$'
+        create: yes
 {{% endif %}}

linux_os/guide/system/network/network-firewalld/ruleset_modifications/firewalld_loopback_traffic_restricted/ansible/shared.yml

@@ -43,7 +43,7 @@
 - name: '{{{ rule_title }}} - Informative Message Based on Service State'
   ansible.builtin.assert:
     that:
-      - ansible_facts.services['firewalld.service'].state == 'running'
+      - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
     fail_msg:
       - firewalld service is not active. Remediation aborted!
       - This remediation could not be applied because it depends on firewalld service running.

linux_os/guide/system/network/network-firewalld/ruleset_modifications/firewalld_loopback_traffic_trusted/ansible/shared.yml

@@ -36,7 +36,7 @@
 - name: '{{{ rule_title }}} - Informative Message Based on Service State'
   ansible.builtin.assert:
     that:
-      - ansible_facts.services['firewalld.service'].state == 'running'
+      - ansible_check_mode or ansible_facts.services['firewalld.service'].state == 'running'
     fail_msg:
       - firewalld service is not active. Remediation aborted!
       - This remediation could not be applied because it depends on firewalld service running.

linux_os/guide/system/software/integrity/software-integrity/aide/aide_check_audit_tools/ansible/shared.yml

@@ -17,6 +17,9 @@
   with_items:
     - aide
 
+- name: "{{{ rule_title }}} - Gather the package facts"
+  ansible.builtin.package_facts:
+    manager: auto
 
 - name: Set audit_tools fact
   set_fact:
@@ -39,11 +42,16 @@
     path: {{{ aide_conf_path }}}
     regexp: ^{{ item }}\s
     line: "{{ item }} {{{ aide_string() }}}"
+    create: true
   with_items: "{{ audit_tools }}"
-
+  when:
+    - '"aide" in ansible_facts.packages'
 
 - name: Configure AIDE to properly protect audit tools
   lineinfile:
     path: {{{ aide_conf_path }}}
     line: "{{ item }} {{{ aide_string() }}}"
+    create: true
   with_items: "{{ audit_tools }}"
+  when:
+    - '"aide" in ansible_facts.packages'

linux_os/guide/system/software/integrity/software-integrity/aide/aide_use_fips_hashes/ansible/shared.yml

@@ -22,15 +22,23 @@
             - gost
             - crc32
 
+- name: "{{{ rule_title }}} - Gather the package facts"
+  ansible.builtin.package_facts:
+    manager: auto
+
 -   name: "{{{ rule_title }}} - Remove forbidden hashes"
     ansible.builtin.replace:
         path: "{{ aide_conf }}"
         regexp: '(^\s*[A-Z][A-Za-z_]*\s*=.*?)({{ item }}\+|\+?{{ item }})(.*)'
         replace: '\1\3'
+    when:
+        - '"aide" in ansible_facts.packages'
     loop: "{{ forbidden_hashes }}"
 
 -   name: "{{{ rule_title }}} - Set sha512"
     ansible.builtin.replace:
         path: "{{ aide_conf }}"
         regexp: '(^\s*[A-Z][A-Za-z_]*\s*=)((?:(?!\+?sha512).)*)\s*$'
         replace: '\1\2+sha512'
+    when:
+        - '"aide" in ansible_facts.packages'

linux_os/guide/system/software/updating/ensure_redhat_gpgkey_installed/ansible/shared.yml

@@ -20,6 +20,7 @@
   {{%- endif %}}
   changed_when: False
   register: gpg_fingerprints
+  failed_when: False
   check_mode: no
 
 - name: Set Fact - Installed GPG Fingerprints