ansible-lockdown / RHEL9-CIS

Ansible role for Red Hat 9 CIS Baseline
https://ansible-lockdown.readthedocs.io
MIT License
119 stars 91 forks source link

Inconsistent conditionals when masking services #135

Closed ipruteanu-sie closed 4 months ago

ipruteanu-sie commented 10 months ago
Describe the Issue The way I understood rules 2.2.16, 2.2.17 and 2.2.18 is this one: Server Service Result
false false Remove 'package'
false true Needing 'service' without needing 'server' makes no sense
true false Mask 'service'
true true SKIP RULE, BOTH 'service' and 'server' are required

Expected Behavior (similar with 2.2.17 or 2.2.18)

      - name: "2.2.16 | PATCH | Ensure nfs-utils is not installed or the nfs-server service is masked | mask service"
        ansible.builtin.systemd:
            name: nfs-server
            masked: true
            state: stopped
        when:
            - rhel9cis_use_nfs_server
            - not rhel9cis_use_nfs_service

Actual Behavior

      - name: "2.2.16 | PATCH | Ensure nfs-utils is not installed or the nfs-server service is masked | mask service"
        ansible.builtin.systemd:
            name: nfs-server
            masked: true
            state: stopped
        when:
            - not rhel9cis_use_nfs_server
            - rhel9cis_use_nfs_service

Control(s) Affected 2.2.16

Environment (please complete the following information):

Possible Solution PR afterwards.

uk-bolly commented 4 months ago

hi @ipruteanu-sie

This Issue has been merged to devel and into main branch. I will therefore close this issue. Please feel free to reopen if you feel its not as expected.

Many thanks again for your time

uk-bolly