Undefined variable rule 5.5

[jlosito]

When running this role using something like the command below, I get the subsequent error. The error is that the rhel_07_5_5_audit variable is undefined.

$ ansible-playbook -i inventory/hosts.yml cis.yml --tags rule_5.5
...
...
...
TASK [rhel7-cis : debug] ***********************************************************************************************
fatal: [somehost]: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'rhel_07_5_5_audit' is undefined\n\nThe error appears to be in '/tmp/tmp0n492yxb/roles/rhel7-cis/tasks/section_5/cis_5.5.yml': line 8, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n  register: rhel_07_5_5_audit\n- debug:\n  ^ here\n"}
...ignoring

I believe the reason why this is happening is because only the debug task has the rule_5.5 tag I'm using associated with it. Another hint that the variable never gets registered is the previous task's output is never shown. In other words, I never see the name output of the previous step in the list of tasks being executed on my screen when running the role with the tag.

I believe wrapping both the cat /etc/securetty step and the debug step into something like the following will fix the issue or adding the same rule_5.5 tag to the step before the debug one.

- block:
  - name: "NOTSCORED | 5.5 | AUDIT | Ensure root login is restricted to system console"
    command: cat /etc/securetty
    changed_when: no
    become: yes
    register: rhel_07_5_5_audit

  - debug:
      msg:
      - "These are the consoles with root login access, please review:"
      - "{{ rhel_07_5_5_audit.stdout_lines }}"
  when:
  - rhel7cis_rule_5_5
  tags:
  - level1
  - audit
  - rule_5.5

[uk-bolly]

hi @jlosito

Thank you for raising this issue and providing a solution. I have raised and requested a PR to resolve this.

Regards

uk-bolly

[jlosito]

@uk-bolly Thank you for opening #214 .

I'm curious of what the release cadence is for this project. After your pull request gets approved and merged, when can I expect that change to be included in the next tagged release?

[georgenalen]

jlosito, We have this issue merged into the devel branch, thanks for raising the issue. As to your cadence question there isn't quite a solid answer on that. With all of the new roles and re-writes of old roles we were pushing releasing quickly as issues came in. However now those are slowing down the plan looks to be one release a month and if things are really really stable one a quarter. However that also depends on severity of the issues found. For example if a high severity issue is found today we will add the and fix cut a release. Lets say two days later a different high severity issue is found we will address that issue and push a new release, resulting in two releases close together. For most things we are going to lump them together in a common monthly release cycle. So I apologize for the answer/not answer on this one, we are still feeling for best cadence on it.

Since we just did our "April" release I'm thinking this fix will make it in the May release. Like I said earlier, it is in the devel branch so you can use it patched. Also when we talk about releases and tags, the main branch is the one we are tagging and treating as an official release branch. So fixes waiting to make it into the release are often times in the devel branch.

George

[uk-bolly]

@jlosito

As you are aware we have carried out some quite major changes to it over the last month( to this and many other repos), so we have been trying to get to these a little quicker than we might be able to going forward. We aim to do this as quickly as we can and tend to put everything into devel branch before releasing to main and a new release is formed. The current thought is if needed maybe a release to main every 4-6 weeks. The majority of work is driven from our clients utilising their ansible counsellor subscription this will of course would take precedence. Sorry not able to provide you with a direct answer. thanks

uk-bolly

p.s. just noticed @georgenalen replied too :)

[jlosito]

@georgenalen @uk-bolly I'm closing this one out since the fix has been merged.