Fix error on applying the sysctl vars on containers (#243)

* Add exception in sysctl task No need apply sysctl in docker and openvz containers. Signed-off-by: Oleg Kupriyanov <[email protected]> * use block for sysctl tasks
dev-sec · Dec 19, 2019 · 75935cb · 75935cb
1 parent 4228e8a
commit 75935cb
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 26 deletions.
diff --git a/.travis.yml b/.travis.yml
@@ -73,7 +73,7 @@ script:
   - 'docker exec "$(cat ${container_id})" ansible-playbook --version'
 
    # Test role.
-  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/tests/test.yml --diff --skip-tags "sysctl"'
+  - 'docker exec "$(cat ${container_id})" ansible-playbook /etc/ansible/roles/ansible-os-hardening/tests/test.yml --diff'
 
    # Verify role
   - 'inspec exec https://github.com/dev-sec/linux-baseline/ -t docker://$(cat ${container_id}) --controls=os-01 os-02 os-03 os-04 os-05 os-05b os-06 os-07 os-09 os-10 os-11 package-01 package-02 package-03 package-05 package-06 package-08 package-09 --no-distinct-exit'

diff --git a/tasks/sysctl.yml b/tasks/sysctl.yml
@@ -35,31 +35,35 @@
   when: ansible_facts.os_family == 'Debian' and os_security_kernel_enable_module_loading
   register: initramfs
 
-- name: create a combined sysctl-dict if overwrites are defined
-  set_fact:
-    sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
-  when: sysctl_overwrite | default()
-
-- name: Change various sysctl-settings, look at the sysctl-vars file for documentation
-  sysctl:
-    name: '{{ item.key }}'
-    value: '{{ item.value }}'
-    sysctl_set: yes
-    state: present
-    reload: yes
-    ignoreerrors: yes
-  with_dict: '{{ sysctl_config }}'
-
-- name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
-  sysctl:
-    name: '{{ item.key }}'
-    value: '{{ item.value }}'
-    state: present
-    reload: yes
-    ignoreerrors: yes
-  with_dict: '{{ sysctl_rhel_config }}'
-  when: ((ansible_facts.distribution == 'RedHat' or ansible_facts.distribution == 'Fedora' or ansible_facts.distribution == 'CentOS') and
-        ansible_distribution_version|int is version('7', '<')) or ansible_facts.distribution == 'Amazon'
+- name: change sysctls
+  block:
+    - name: create a combined sysctl-dict if overwrites are defined
+      set_fact:
+        sysctl_config: '{{ sysctl_config | combine(sysctl_overwrite) }}'
+      when: sysctl_overwrite | default()
+
+    - name: Change various sysctl-settings, look at the sysctl-vars file for documentation
+      sysctl:
+        name: '{{ item.key }}'
+        value: '{{ item.value }}'
+        sysctl_set: yes
+        state: present
+        reload: yes
+        ignoreerrors: yes
+      with_dict: '{{ sysctl_config }}'
+
+    - name: Change various sysctl-settings on rhel6-hosts or older, look at the sysctl-vars file for documentation
+      sysctl:
+        name: '{{ item.key }}'
+        value: '{{ item.value }}'
+        state: present
+        reload: yes
+        ignoreerrors: yes
+      with_dict: '{{ sysctl_rhel_config }}'
+      when: ((ansible_facts.distribution == 'RedHat' or ansible_facts.distribution == 'Fedora' or ansible_facts.distribution == 'CentOS') and
+            ansible_distribution_version|int is version('7', '<')) or ansible_facts.distribution == 'Amazon'
+
+  when: ansible_virtualization_type not in ['docker', 'openvz', 'lxc']
 
 - name: Apply ufw defaults
   template: