openstack/ansible-hardening
Code Issues Proposed changes

Properly resolve pam_auth_file in a loop

Browse Source 
Since ansible-core 2.19 we should use variable directly,
and do not attempt to resolve a variable inside of jinja defenition,
as this is considered as unsafe.

Change-Id: Ic10a27c0e7b9556eb307b05d9f7a1b3e52667a8e
Signed-off-by: Dmitriy Rabotyagov <dmitriy.rabotyagov@cleura.com>
This commit is contained in:
Dmitriy Rabotyagov
2026-02-03 13:36:16 +01:00
parent 40d21f2f6d
commit 2f396ed177
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
tasks/rhel7stig/auth.yml
View File

@@ -54,7 +54,7 @@
line: "\\1\\2"
backup: true
backrefs: true
loop: "{{ ['auth', 'password'] | product(['{{ pam_auth_file }}', '{{ pam_password_file }}']) | list }}"
loop: "{{ ['auth', 'password'] | product([pam_auth_file, pam_password_file]) | list }}"
when:
- ansible_facts['os_family'] == 'RedHat'
- security_disallow_blank_password_login | bool

2
tasks/rhel7stig/kernel.yml
View File

@@ -68,7 +68,7 @@
enabled: false
when:
- kdump_service_check.rc not in [3,4]
- security_disable_kdump
- security_disable_kdump | bool
tags:
- kernel
- medium