ComplianceAsCode / ComplianceAsCode/content

when conditionals in RHEL STIG roles fail with ansible-core 2.19+

Open
#15,005 1 comment 0 reactions 0 assignees View on GitHub
Ansible RHEL triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:

Some Ansible when conditionals contain an additional pair of quotes around membership tests. This causes the membership test to be evaluated as a string literal instead of a boolean expression.

Ansible-core 2.19+ requires conditional results to be boolean and the affected tasks fail during conditional evaluation.

The issue is observable in redhatofficial.rhel9_stig and redhatofficial.rhel10_stig roles.

For example, the AIDE condition contains:
`find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"`
instead of:
`find_rules_groups_results is not skipped and 'aide' in ansible_facts.packages`

The audit privileged-functions condition similarly contains:
`('"auditd.service" in ansible_facts.services' or '"augenrules.service" in ansible_facts.services')`
instead of:
`("auditd.service" in ansible_facts.services or "augenrules.service" in ansible_facts.services)`

#### Operating System Version:
RHEL 9 / RHEL 10

#### Actual Results:
The role fails during conditional evaluation under ansible-core 2.19+ because the quoted membership expression produces a non-boolean result.
`[ERROR]: Task failed: Conditional result (True) was derived from value of type 'str' at '/home/app/.ansible/roles/redhatofficial.rhel10_stig/tasks/main.yml:1957:5'. Conditionals must have a boolean result.`

#### Expected Results:
Generate the membership tests as boolean expressions without the additional quoting, allowing the RHEL 9 and RHEL 10 STIG roles to run with ansible-core 2.19+.

Contributor guide

Open the contributing guide

Research direction

Start with the generated tasks/main.yml for the redhatofficial.rhel9_stig and redhatofficial.rhel10_stig roles, including the reported failure near line 1957, and inspect how the AIDE and audit privileged-functions conditionals are produced. Run the roles with ansible-core 2.19+ on RHEL 9 or RHEL 10; done means the membership tests evaluate as booleans without conditional-evaluation failures.

Written by the indexing model from the issue text.

Assessment

Tech stack
ansible
Domain
devops, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.