when: ansible_virtualization_role != "guest" or
ansible_virtualization_type != "docker" is the same as
when: not (ansible_virtualization_role == "guest" and
ansible_virtualization_type == "docker"),
i.e. it means that the task is not executed only and only on Docker
containers. It is executed on Docker hosts and on VMs though.
Rules that are about kernel parameters, services enabled etc. are not
applicable to containers the same way as they are applicable to
bare-metal machines and VMs, so we disable the respective Ansible
remediation.
If your use case is about remediating VMs, you can keep the when: clause
there, as it doesn't make any difference. Check out output of the
ansible all -m gather_facts -i <VM hostname/IP>, | grep virtualization
command - I get
"ansible_virtualization_role": "guest",
"ansible_virtualization_type": "kvm",
and therefore in my case, the result of the when condition would
evaluate to true - it is either (false or true) = true for the first
form, or (not (true and false)) = true for the second form.
In other words, if a task gets skipped on VMs, this when: can't be the
cause unless there is a problem with Ansible.
Hope it helps,
Matej
On 11. 02. 20 18:46, Link, Henry L II CTR USN NIWC ATLANTIC SC (USA) wrote:
Good afternoon! I am new to this list, and would normally lurk a bit
more first, but I have a question I am hoping the community might be
able to help me with.
I have been reviewing the ansible playbook content for the NIAP OSPP
for RHEL 8 on the following site:
https://static.open-scap.org/ssg-guides/ssg-rhel8-guide-index.html
And I came across what has been labeled the “[DRAFT] DISA STIG for Red
Hat Enterprise Linux 8”
It just so happens to mirror the NIAP OSPP guidance, no surprise there
for a first draft. However, a large number of the tasks in the
playbook are restricted with the WHEN statement:
- when: ansible_virtualization_role != "guest" or
ansible_virtualization_type != "docker"
These filters are from the original NIAP OSPP ansible guidance as well.
Does anyone have an understanding why these tasks are filtered out for
virtual machines? The text guidance makes no mention why these would
be excluded, and in fact other code snippets (e.g. the bash scripts)
don’t include an exclusion like this. Even in cases like CCE-81024-2,
I’ve never had issues with enabling this on virtual guests in the past
(in VMWare, mind you), but items like CCE-82297-3 (tipc disable) or
CCE-80834-5 (sctp disable) they don’t cause any significant issues for
a virtual guest where these are disabled. (My interest is in use in a
DoD implementation, and though there is no STIG yet, I am negotiating
with our accrediting body on appropriate controls until the STIG is
available.)
If anyone has any further insight why these were restricted with
“when” directives in the ansible role/playbook for Draft STIG and
NIAP, thank you in advance. For my part, I’m removing the clause for
my implementation, but wanted to see what the original reason was and
if it was something I should be aware of to avoid any future
unforeseen issues.
v/r
Henry Link
_______________________________________________
scap-security-guide mailing list -- scap-security-guide(a)lists.fedorahosted.org
To unsubscribe send an email to scap-security-guide-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/scap-security-guide@lists.fe...