Manually check apparmor_status

The apparmor systemd unit file simply calls an old SysV init script
to load AppArmor profiles. The init script exits and systemd has no
idea if it's still running or not. This causes Ansible to start
the apparmor unit each time the playbook runs, which breaks the
idempotency checks.

This patch checks the apparmor_status output directly to see what the
status of AppArmor actually is. If the module is loaded, then we
should not try to start AppArmor with the unit file again.

This patch also includes the updates from the openstack-ansible-tests
repository that were included in
https://review.openstack.org/#/c/488489/ so that the gate can be
unblocked.

Partial-Bug: 1710675
Change-Id: If253714d0ca4b5a3d324255751e6f6615ca75dde

Vagrantfile

@@ -36,6 +36,10 @@ Vagrant.configure(2) do |config|
     leap422.vm.box = "opensuse/openSUSE-42.2-x86_64"
   end
 
+  config.vm.define "opensuse423" do |leap423|
+    leap423.vm.box = "opensuse/openSUSE-42.3-x86_64"
+  end
+
   config.vm.define "centos7" do |centos7|
     centos7.vm.box = "centos/7"
   end

bindep.txt

@@ -30,6 +30,9 @@ libffi-dev        [platform:dpkg]
 python2.7         [platform:dpkg]
 python-apt        [platform:dpkg]
 python-dev        [platform:dpkg]
+python3           [platform:dpkg]
+python3-apt       [platform:dpkg]
+python3-dev       [platform:dpkg]
 
 # Base requirements for RPM distros
 gcc               [platform:rpm]
@@ -51,8 +54,7 @@ python-pyasn1               [platform:dpkg platform:suse]
 python-openssl              [platform:dpkg]
 python-ndg-httpsclient      [platform:ubuntu !platform:ubuntu-14]
 python2-pyasn1              [platform:redhat]
-python2-pyOpenSSL           [platform:redhat !platform:fedora]
-pyOpenSSL                   [platform:fedora]
+pyOpenSSL                   [platform:redhat]
 python-pyOpenSSL            [platform:opensuseproject-42]
 python2-pyOpenSSL           [platform:suse !platform:opensuseproject-42]
 python-ndg_httpsclient      [platform:redhat !platform:fedora]

run_tests.sh

@@ -35,9 +35,12 @@ source /etc/os-release || source /usr/lib/os-release
 install_pkg_deps() {
     pkg_deps="git"
 
+    # Prefer dnf over yum for CentOS.
+    which dnf &>/dev/null && RHT_PKG_MGR='dnf' || RHT_PKG_MGR='yum'
+
     case ${ID,,} in
         *suse*) pkg_mgr_cmd="zypper -n in" ;;
-        centos|rhel) pkg_mgr_cmd="yum install -y" ;;
+        centos|rhel) pkg_mgr_cmd="${RHT_PKG_MGR} install -y" ;;
         fedora) pkg_mgr_cmd="dnf -y install" ;;
         ubuntu|debian) pkg_mgr_cmd="apt-get install -y" ;;
         *) echo "unsupported distribution: ${ID,,}"; exit 1 ;;

tasks/rhel7stig/lsm.yml

@@ -24,6 +24,22 @@
     - high
     - V-71989
 
+# NOTE(mhayden): The systemd unit file for apparmor just calls an old SysV
+# init script and exits. It's not possible to ask systemd if apparmor is
+# running and if we tell systemd to start apparmor, it will tell us that it
+# started apparmor each time. This breaks idempotency and we check
+# apparmor_status directly as an alternative.
+- name: Check if apparmor is running
+  command: apparmor_status
+  register: apparmor_status_output
+  changed_when: false
+  failed_when: false
+  when:
+    - ansible_pkg_mgr in ['apt', 'zypper']
+  tags:
+    - high
+    - V-71989
+
 - name: Ensure AppArmor is running
   service:
     name: apparmor
@@ -34,6 +50,7 @@
     - security_rhel7_enable_linux_security_module | bool
     - not check_mode
     - '"AppArmor disabled by boot time parameter" not in dmesg_apparmor_output.stdout'
+    - '"apparmor module is loaded" in apparmor_status_output.stdout'
   tags:
     - high
     - V-71989