search

dev-sec / ansible-collection-hardening

This Ansible collection provides battle tested hardening for Linux, SSH, nginx, MySQL
http://dev-sec.io/
Apache License 2.0
4.09k stars 732 forks source link

os_hardening gpg-check enabled fails on success #549

Closed BadJukeBox closed 2 years ago

BadJukeBox commented 2 years ago

Describe the bug The os_hardening yum tasks task for "Activate gpg-check for config files" fails on rc == 0. This appears to just be a successful run, unless I am mistaken. I can make a PR for this but wanted to check in and get confirmation whether or not 0 is considered an error code. Apologies if I'm missing something obvious, just trying to get some further information

Expected behavior when the loop edits the specified file to turn gpg-checking on, RC status code 0 should be accepted as a success case instead of a failure.

Actual behavior

TASK [devsec.hardening.os_hardening: Activate gpg-check for config files] *****
failed: [default] (item=/etc/yum.conf) => {"ansible_loop_var": "item", "changed": false, "failed_when_result": true, "item": "/etc/yum.conf", "msg": "", "rc": 0}

OS / Environment

Role Version

6.2.0

Additional context Weirdly, this was not an issue previously on Amazon Linux 2 before, but has recently come up as an issue, likely due to some change in amazon linux or yum configs.

schurzi commented 2 years ago

Hi @BadJukeBox, thank you for the report! By chance I also discovered this this weekend and already prepared a fix in #547 This will be merged in a few minutes. ;)