openstack/ansible-hardening
Code Issues Proposed changes

Skip some test assertions for RHEL7 STIG

Browse Source 
This patch skips the assertions on the test tasks that run after
the security role is applied. These should only run on the RHEL6
STIG content for now.

Change-Id: Ibee89def31fea8263f92666e593f7d44bd21cbc6
This commit is contained in:
Major Hayden 2016-10-05 14:47:49 -05:00
parent 687dcdc3ea
commit 4e7e57add2
1 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
tests/test.yml
View File

@ -31,26 +31,36 @@
stat:
path: /etc/apt/apt.conf.d/20auto-upgrades
register: auto_upgrades_file
when: ansible_pkg_mgr == 'apt'
when:
- stig_version == 'rhel6'
- ansible_pkg_mgr == 'apt'
- name: Slurp contents of 50unattended-upgrades file
slurp:
src: /etc/apt/apt.conf.d/50unattended-upgrades
register: unattended_upgrades_file_encoded
when: ansible_pkg_mgr == 'apt'
when:
- stig_version == 'rhel6'
- ansible_pkg_mgr == 'apt'
- name: Decode slurp'd 50-unattended-upgrades file
set_fact:
unattended_upgrades_file: "{{ unattended_upgrades_file_encoded.content | b64decode }}"
when: ansible_pkg_mgr == 'apt'
when:
- stig_version == 'rhel6'
- ansible_pkg_mgr == 'apt'
- name: Ensure auto updates has been enabled
assert:
that:
- auto_upgrades_file.stat.exists
when: ansible_pkg_mgr == 'apt'
when:
- stig_version == 'rhel6'
- ansible_pkg_mgr == 'apt'
- name: Ensure that auto update notifications has been enabled
assert:
that:
- "'\nUnattended-Upgrade::Mail \"root\";\n' in unattended_upgrades_file"
when: ansible_pkg_mgr == 'apt'
when:
- stig_version == 'rhel6'
- ansible_pkg_mgr == 'apt'
roles:
- role: "openstack-ansible-security"
vars: