Skip to content

4.4.1 is not idempotent #135

@gee-mo

Description

@gee-mo

Have you checked ReadtheDocs?:

Describe the Issue
4.4.1 performs a authselect create-profile. However, if the profile already exists, as would be the case when the playbook is run for a second time, the shell command will fail with 'profile already exists' and the playbook abends. For comparison, it looks like the RHEL8-CIS (4.4.2.1) appropriately handles this by doing a PRELIM check to see if the current profile differs from the target profile.

Expected Behavior
Identify the current profile is correct and skip

Actual Behavior
"[error] Profile "<masked_profile_name" already exist at [/etc/authselect/custom/<masked_profile_name>]\nUnable to create new profile [17]: File exists", "stderr_lines": ["[error] Profile "<masked_profile_name>" already exist at [/etc/authselect/custom/<masked_profile_name>]", "Unable to create new profile [17]: File exists"], "stdout": "", "stdout_lines": []}

Control(s) Affected
4.4.1, 4.4.2

Environment (please complete the following information):

  • branch being used: devel
  • Ansible Version: unsure
  • Host Python Version: Unsure
  • Ansible Server Python Version: Unsure
  • Additional Details:

Additional Notes

Possible Solution
Review RHEL8-CIS 4.4.2.1 where it seems to appropriately handles this by doing a PRELIM check to register the current profile and use it for comparison to see if it differs from the target profile.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions