Devel to main release

[uk-bolly]

Overall Review of Changes:
Next release including many bug fixes and improvements

Issue Fixes:

thanks to @jonawang

• tags typo for rhel8cis_rule_5_6_1_3 in file cis_5.6.1.x.yml ? #261

thanks to @Crayeth

• rhel8cis_rule_3_3_9 is skipped when ipv6 is not required #278
  • Added new options to allow ipv6 rules if required although ipv6 disabled
  • rhel8cis_ipv6_sysctl_force
  • default: true

thanks to @Thulium-Drake

• New style 4.2.3 ensure permission task takes ages #286
  • revert back to shell due to system impact

thanks to @bbaassssiiee

• CIS-CAT-PRO audit finding 4.2.2.3 #279

• CIS-CAT-PRO audit finding 4.2.2.4 #280

• CIS-CAT-PRO audit finding 5.3.7 #281

• CIS-CAT-PRO finding 5.4.2 #284

  • new option to allow manual changes to pamd files without using authconfig
  • rhel8cis_5_4_2_risks need sto be set to ACCEPT to run
  • default: NEVER

• Packages are updated, but old kernels are not removed #287

  • new variables as part of rule_1.9

    rhel8cis_apply_installed_kernel_limit: false
    rhel8cis_installed_kernel_limit: 2

  • Assert that: rhel8cis_crypto_policy in rhel8cis_allowed_crypto_policies does not allow policy modules #295
  • ansible.posix.sysctl settings in /etc/sysctl.conf #296
  • (3.4.2) tcp-wrappers is no longer in use it seems, this template is not used #298
  • IPv6 on localhost important #299
  • disable ipv6 for sshd - rhel8cis_ipv6_sshd_disable: false (default) - added to prelim
  • disable ipv6 for chrony - rhel8cis_ipv6_chrony_disable: false (default) - added to prelim
  • turn off ipv6 for localhost - rhel8cis_ipv6_disable_localhost: false (default) - refer https://access.redhat.com/solutions/8709

Enhancements:
Linting
container updates

How has this been tested?:
Manually
in devel for the last week with latest merge
pipeline

[bbaassssiiee]

When I run ansible-lint 6.4.0 with ansible 2.13.3 in the role's dir I noticed:

tasks/section_1/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_2/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_3/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_4/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_5/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_6/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])

The warning_facts.yml is in the parent dir of the sections tasks files.

[uk-bolly]

When I run ansible-lint 6.4.0 with ansible 2.13.3 in the role's dir I noticed:

tasks/section_1/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_2/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_3/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_4/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_5/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])
tasks/section_6/warning_facts.yml:1: load-failure (load-failure[filenotfounderror])

The warning_facts.yml is in the parent dir of the sections tasks files.

Hi @bbaassssiiee

Thank for this, going through this today i'm not seeing the warning you are seeing. Im using a much newer version of ansible-lint
have tried both
ansible-lint 6.7.0
ansible-lint 6.17.2 (updated today and have a newer yamllint for a new branch i'm working on)

Many thanks

uk-bolly

[georgenalen]

looks good!