search

freedomofpress / ansible-role-grsecurity

The documentation and build system for the grsecurity kernel maintained by the Freedom of the Press Foundation for SecureDrop
GNU General Public License v2.0
49 stars 13 forks source link

Fixes reboot logic (again) #97

Closed conorsch closed 7 years ago

conorsch commented 7 years ago

The changes brought in via #95 did indeed resolve the wait_for task being skipped, but with the unintended side-effect of optimistically rebooting hosts, even if they were already running the desired kernel version. That's no good.

Updated the reboot task with conditional logic to skip if the kernel matches, and chained the subsequent wait tasks on that result.

Closes #94.

conorsch commented 7 years ago

Thanks for review, @fowlslegs!

Is the extra wait time to ensure all services are up and running before proceeding?

Yes, since as soon as 22 is open for a socket, the role will continue executing. One option is to use the search_regex parameter to expect a string match returned by sshd, but I since I haven't tested that thoroughly, I didn't implement it. The extra wait-time is configurable via a role var for the impatient.