ComplianceAsCode / ComplianceAsCode/content
when conditionals in RHEL STIG roles fail with ansible-core 2.19+
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Description of problem:
Some Ansible when conditionals contain an additional pair of quotes around membership tests. This causes the membership test to be evaluated as a string literal instead of a boolean expression.
Ansible-core 2.19+ requires conditional results to be boolean and the affected tasks fail during conditional evaluation.
The issue is observable in redhatofficial.rhel9_stig and redhatofficial.rhel10_stig roles.
For example, the AIDE condition contains:
`find_rules_groups_results is not skipped and "'aide' in ansible_facts.packages"`
instead of:
`find_rules_groups_results is not skipped and 'aide' in ansible_facts.packages`
The audit privileged-functions condition similarly contains:
`('"auditd.service" in ansible_facts.services' or '"augenrules.service" in ansible_facts.services')`
instead of:
`("auditd.service" in ansible_facts.services or "augenrules.service" in ansible_facts.services)`
#### Operating System Version:
RHEL 9 / RHEL 10
#### Actual Results:
The role fails during conditional evaluation under ansible-core 2.19+ because the quoted membership expression produces a non-boolean result.
`[ERROR]: Task failed: Conditional result (True) was derived from value of type 'str' at '/home/app/.ansible/roles/redhatofficial.rhel10_stig/tasks/main.yml:1957:5'. Conditionals must have a boolean result.`
#### Expected Results:
Generate the membership tests as boolean expressions without the additional quoting, allowing the RHEL 9 and RHEL 10 STIG roles to run with ansible-core 2.19+.
Contributor guide
Research direction
Start with the generated tasks/main.yml for the redhatofficial.rhel9_stig and redhatofficial.rhel10_stig roles, including the reported failure near line 1957, and inspect how the AIDE and audit privileged-functions conditionals are produced. Run the roles with ansible-core 2.19+ on RHEL 9 or RHEL 10; done means the membership tests evaluate as booleans without conditional-evaluation failures.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ansible
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100