ansible-lockdown / RHEL7-STIG

Ansible role for Red Hat 7 STIG Baseline
MIT License
282 stars 144 forks source link

Task validation fixes and rewrites (by Steampunk Spotter) #437

Closed anzoman closed 11 months ago

anzoman commented 11 months ago

Overall Review of Changes: These changes will try to correct some errors and incorporate multiple hints within Ansible tasks that I have encountered when running some checks with Steampunk Spotter.

Enhancements: The first change fixes the following error detected by the Spotter CLI:

(.venv) user@ubuntu:~/UBUNTU22-CIS$ spotter scan --ansible-version 2.12 --display-level error .
Scanning...success. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 100% 0:00:00
------------------------------------------------------------------------
tasks/fix-cat2.yml:1108:9: ERROR: [E001] with_items is not a valid parameter in module ansible.builtin.package.
tasks/prelim.yml:55:9: ERROR: [E005] state is a required parameter in module ansible.builtin.package.
tasks/prelim.yml:148:3: ERROR: [E005] state is a required parameter in module ansible.builtin.package.
tasks/prelim.yml:210:3: ERROR: [E005] state is a required parameter in module ansible.builtin.package.
tasks/prelim.yml:282:3: ERROR: [E005] state is a required parameter in module ansible.builtin.package.
tasks/prelim.yml:310:3: ERROR: [E005] state is a required parameter in module ansible.builtin.package.
tasks/prelim.yml:384:3: ERROR: [E005] state is a required parameter in module ansible.builtin.package.
tasks/prelim.yml:399:9: ERROR: [E005] state is a required parameter in module ansible.builtin.package.
------------------------------------------------------------------------
Spotter took 2.798 s to scan your input.
It resulted in 7 error(s), 151 warning(s) and 122 hint(s).
Overall status: ERROR

I've also used Spotter's rewrite feature (--rewrite) to correct a bad practice of inline passing of parameters to modules and replaced that with exact parameters.

How has this been tested?: N/A