Switch to using import_tasks for static inclusion
Using dynamic inclusion (include_tasks) should only be done if the tasks to include are based on a conditional and there is no expectation for the tag on the include task to be applied to all included tasks. Using include_tasks for static inclusion dramatically raises memory consumption. Using include_tasks also breaks the ability to use a tag applied to the include. In this patch we fix all inclusions to ensure that they are set properly to dynamic or static inclusions where necessary. We also remove the unnecessary leading whitespace in the main task file. Change-Id: Idff86d4a90d3309f0e9ae3b9f0559b37e25dc26f Closes-Bug: #1800169
This commit is contained in:
Jesse Pretorius
parent
b792753b34
commit
f381cc02af
@ -13,47 +13,47 @@
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
- name: Gather variables for each operating system
|
||||
include_vars: "{{ item }}"
|
||||
with_first_found:
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml"
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
|
||||
- "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
|
||||
- "{{ ansible_distribution | lower }}.yml"
|
||||
- "{{ ansible_os_family | lower }}.yml"
|
||||
tags:
|
||||
- always
|
||||
- name: Gather variables for each operating system
|
||||
include_vars: "{{ item }}"
|
||||
with_first_found:
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml"
|
||||
- "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
|
||||
- "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml"
|
||||
- "{{ ansible_distribution | lower }}.yml"
|
||||
- "{{ ansible_os_family | lower }}.yml"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Check for check/audit mode
|
||||
command: /bin/true
|
||||
register: noop_result
|
||||
changed_when: False
|
||||
tags:
|
||||
- always
|
||||
- name: Check for check/audit mode
|
||||
command: /bin/true
|
||||
register: noop_result
|
||||
changed_when: False
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Check to see if we are booting with EFI or UEFI
|
||||
set_fact:
|
||||
booted_with_efi: "{{ ansible_mounts | selectattr('mount', 'equalto', '/boot/efi') | list | length > 0 }}"
|
||||
tags:
|
||||
- always
|
||||
- name: Check to see if we are booting with EFI or UEFI
|
||||
set_fact:
|
||||
booted_with_efi: "{{ ansible_mounts | selectattr('mount', 'equalto', '/boot/efi') | list | length > 0 }}"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Set facts
|
||||
set_fact:
|
||||
check_mode: "{{ noop_result is skipped }}"
|
||||
linux_security_module: "{{ (ansible_os_family == 'Debian') | ternary('apparmor','selinux') }}"
|
||||
grub_config_file_boot: "{{ booted_with_efi | ternary(grub_conf_file_efi, grub_conf_file) }}"
|
||||
tags:
|
||||
- always
|
||||
- name: Set facts
|
||||
set_fact:
|
||||
check_mode: "{{ noop_result is skipped }}"
|
||||
linux_security_module: "{{ (ansible_os_family == 'Debian') | ternary('apparmor','selinux') }}"
|
||||
grub_config_file_boot: "{{ booted_with_efi | ternary(grub_conf_file_efi, grub_conf_file) }}"
|
||||
tags:
|
||||
- always
|
||||
|
||||
- name: Check if grub is present on the remote node
|
||||
stat:
|
||||
path: "{{ grub_update_cmd.split(' ')[0] }}"
|
||||
register: grub_update_binary
|
||||
tags:
|
||||
- always
|
||||
- name: Check if grub is present on the remote node
|
||||
stat:
|
||||
path: "{{ grub_update_cmd.split(' ')[0] }}"
|
||||
register: grub_update_binary
|
||||
tags:
|
||||
- always
|
||||
|
||||
- include_tasks: "{{ stig_version }}stig/main.yml"
|
||||
- import_tasks: "{{ stig_version }}stig/main.yml"
|
||||
|
||||
- include_tasks: contrib/main.yml
|
||||
when:
|
||||
- security_contrib_enabled | bool
|
||||
- include_tasks: contrib/main.yml
|
||||
when:
|
||||
- security_contrib_enabled | bool
|
||||
|
||||
@ -33,7 +33,7 @@
|
||||
|
||||
# Some of the tasks in the role may take a long time to run. Let's start them
|
||||
# as early as possible so they have time to finish.
|
||||
- include_tasks: async_tasks.yml
|
||||
- import_tasks: async_tasks.yml
|
||||
|
||||
- name: Get user data for all users on the system
|
||||
get_users:
|
||||
@ -66,7 +66,7 @@
|
||||
|
||||
# Package installations and removals must come first so that configuration
|
||||
# changes can be made later.
|
||||
- include_tasks: packages.yml
|
||||
- import_tasks: packages.yml
|
||||
tags:
|
||||
- always
|
||||
|
||||
@ -78,16 +78,16 @@
|
||||
# each file are tagged with the same name (for example, tasks in `auth.yml`
|
||||
# are tagged with `auth`). Also, the tag name matches up with the "STIG
|
||||
# Controls by Tag" section of the role documentation.
|
||||
- include_tasks: accounts.yml
|
||||
- include_tasks: aide.yml
|
||||
- include_tasks: auditd.yml
|
||||
- include_tasks: auth.yml
|
||||
- include_tasks: file_perms.yml
|
||||
- include_tasks: graphical.yml
|
||||
- include_tasks: kernel.yml
|
||||
- include_tasks: lsm.yml
|
||||
- include_tasks: misc.yml
|
||||
- include_tasks: sshd.yml
|
||||
- import_tasks: accounts.yml
|
||||
- import_tasks: aide.yml
|
||||
- import_tasks: auditd.yml
|
||||
- import_tasks: auth.yml
|
||||
- import_tasks: file_perms.yml
|
||||
- import_tasks: graphical.yml
|
||||
- import_tasks: kernel.yml
|
||||
- import_tasks: lsm.yml
|
||||
- import_tasks: misc.yml
|
||||
- import_tasks: sshd.yml
|
||||
|
||||
- name: Remove the temporary directory
|
||||
file:
|
||||
|
||||
Loading…
Reference in New Issue
Block a user