From b8fd95776ce894006163b2bb5e34682e5844ca1e Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Thu, 21 Oct 2021 14:43:51 -0500
Subject: [PATCH 1/5] Always esacpe parameter in ansible_set_config_file
---
.../ansible/shared.yml | 5 +++--
.../ansible/shared.yml | 5 +++--
.../ansible/shared.yml | 5 +++--
shared/macros-ansible.jinja | 17 ++++++++++-------
4 files changed, 19 insertions(+), 13 deletions(-)
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
index 637f90003b2..ca5a405f877 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdriverauthmode/ansible/shared.yml
@@ -5,5 +5,6 @@
# disruption = low
{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf",
- "$ActionSendStreamDriverAuthMode", separator=' ', separator_regex='\s',
- value="x509/name", create='yes') }}}
+ "$ActionSendStreamDriverAuthMode", separator=' ', separator_regex='\s',
+ value="x509/name", create='yes')
+}}}
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
index 5d11103fc0f..1f001f47e07 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_actionsendstreamdrivermode/ansible/shared.yml
@@ -4,6 +4,7 @@
# complexity = low
# disruption = low
-{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
- parameter="$ActionSendStreamDriverMode", value="1", create=true, separator=" ", separator_regex=" ")
+{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf",
+ parameter="$ActionSendStreamDriverMode", value="1", create=true, separator=" ",
+ separator_regex=" ")
}}}
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
index 035ab152876..4016a08721e 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
@@ -4,6 +4,7 @@
# complexity = low
# disruption = low
-{{{ ansible_set_config_file(file="/etc/rsyslog.d/encrypt.conf",
- parameter="$DefaultNetstreamDriver", value="gtls", create=true, separator=" ", separator_regex=" ")
+{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf",
+ parameter="$DefaultNetstreamDriver", value="gtls", create=true, separator=" "
+ , separator_regex=" ")
}}}
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 563350743fe..0f8dba56dab 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -25,14 +25,17 @@ value: "Setting={{ varname1 }}"
Note that all string-like parameters are single quoted in the YAML.
#}}
-{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False) -%}}
+{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False, escape_regex=False) -%}}
- name: "{{{ msg or rule_title }}}"
lineinfile:
path: '{{{ path }}}'
create: {{{ create }}}
- {{%- if regex %}}
+ {{%- if regex and not escape_regex %}}
regexp: '{{{ regex }}}'
{{%- endif %}}
+ {{%- if regex and escape_regex %}}
+ regexp: '{{ {{{ regex }}} | regex_escape }}'
+ {{%- endif %}}
{{%- if state == 'present' %}}
line: '{{{ new_line }}}'
state: present
@@ -121,7 +124,7 @@ value: "Setting={{ varname1 }}"
ini configuration files are best served with the ini Ansible module
instead of lineinfile-based solutions.
#}}
-{{%- macro ansible_set_config_file(msg, file, parameter, separator=' ', separator_regex='\s+', value='', prefix_regex='^\s*', create='no', validate='', insert_after='', insert_before='') %}}
+{{%- macro ansible_set_config_file(msg, file, parameter, separator=' ', separator_regex='\s+', value='', prefix_regex='^\s*', create='no', validate='', insert_after='', insert_before='', escape_regex=False) %}}
{{{ ansible_only_lineinfile(msg, file, prefix_regex + parameter + separator_regex, parameter + separator + value, create=create, block=True, validate=validate, insert_after=insert_after, insert_before=insert_before) }}}
{{%- endmacro %}}
@@ -143,12 +146,12 @@ value: "Setting={{ varname1 }}"
{{%- set new_line = parameter + separator + value -%}}
- name: '{{{ msg or rule_title }}}'
block:
- {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True)|indent }}}
- {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1')|indent }}}
+ {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True, escape_regex=True)|indent }}}
+ {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1', escape_regex=True)|indent }}}
{{{ ansible_stat("Check if " + config_dir + " exists", path=config_dir, register=dir_exists)|indent }}}
{{{ ansible_find("Check if the parameter " + parameter + " is present in " + config_dir, paths=config_dir, contains=line_regex, register=dir_parameter, when=find_when)|indent }}}
- {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when)|indent }}}
- {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before)|indent }}}
+ {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when, escape_regex=True)|indent }}}
+ {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before, escape_regex=True)|indent }}}
{{%- endmacro %}}
{{#
From 5635bf94c9274511e3d63feb8d4082c4ec9144f3 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Tue, 26 Oct 2021 13:01:27 -0500
Subject: [PATCH 2/5] Fix a couple items from reviewers on ansible_lineinfile
escaping
---
.../ansible/shared.yml | 4 ++--
shared/macros-ansible.jinja | 3 +--
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
index 4016a08721e..3cc18d4476e 100644
--- a/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
+++ b/linux_os/guide/system/logging/ensure_rsyslog_log_file_configuration/rsyslog_encrypt_offload_defaultnetstreamdriver/ansible/shared.yml
@@ -5,6 +5,6 @@
# disruption = low
{{{ ansible_set_config_file_dir(msg, "/etc/rsyslog.conf", "/etc/rsyslog.d", "/etc/rsyslog.conf",
- parameter="$DefaultNetstreamDriver", value="gtls", create=true, separator=" "
- , separator_regex=" ")
+ parameter="$DefaultNetstreamDriver", value="gtls", create=true,
+ separator=" ", separator_regex=" ")
}}}
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 0f8dba56dab..752d220bbfc 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -32,8 +32,7 @@ value: "Setting={{ varname1 }}"
create: {{{ create }}}
{{%- if regex and not escape_regex %}}
regexp: '{{{ regex }}}'
- {{%- endif %}}
- {{%- if regex and escape_regex %}}
+ {{%- elif regex and escape_regex %}}
regexp: '{{ {{{ regex }}} | regex_escape }}'
{{%- endif %}}
{{%- if state == 'present' %}}
From f6541126a4d19bfef8752028467659ab9d9f74ed Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Tue, 2 Nov 2021 08:32:18 -0500
Subject: [PATCH 3/5] Fix escaping in ansible_lineinfile macro
---
shared/macros-ansible.jinja | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 752d220bbfc..1e0ba6260bb 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -33,7 +33,7 @@ value: "Setting={{ varname1 }}"
{{%- if regex and not escape_regex %}}
regexp: '{{{ regex }}}'
{{%- elif regex and escape_regex %}}
- regexp: '{{ {{{ regex }}} | regex_escape }}'
+ regexp: {{{ regex }}} | regex_escape
{{%- endif %}}
{{%- if state == 'present' %}}
line: '{{{ new_line }}}'
From ef6d300a707dc272eaa9442ece135009287bfdf5 Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Wed, 3 Nov 2021 11:15:11 -0500
Subject: [PATCH 4/5] Move regex_escape to ansible_set_config_file_dir
---
shared/macros-ansible.jinja | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 1e0ba6260bb..8e7ce1a1206 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -25,15 +25,13 @@ value: "Setting={{ varname1 }}"
Note that all string-like parameters are single quoted in the YAML.
#}}
-{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False, escape_regex=False) -%}}
+{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False) -%}}
- name: "{{{ msg or rule_title }}}"
lineinfile:
path: '{{{ path }}}'
create: {{{ create }}}
- {{%- if regex and not escape_regex %}}
+ {{%- if regex %}}
regexp: '{{{ regex }}}'
- {{%- elif regex and escape_regex %}}
- regexp: {{{ regex }}} | regex_escape
{{%- endif %}}
{{%- if state == 'present' %}}
line: '{{{ new_line }}}'
@@ -138,19 +136,19 @@ value: "Setting={{ varname1 }}"
{{%- set var_dir = config_dir | replace("/", "_") | replace("-", "_") | replace(".", "_") -%}}
{{%- set dir_exists = var_dir + "_exists" -%}}
{{%- set dir_parameter = var_dir + "_has_parameter" -%}}
-{{%- set line_regex = prefix_regex + parameter + separator_regex -%}}
+{{%- set line_regex = prefix_regex + "{{\"" + parameter + "\"| regex_escape }}" + separator_regex -%}}
{{%- set find_when = dir_exists + ".stat.isdir is defined and " + dir_exists + ".stat.isdir" -%}}
{{%- set lineinfile_items = "{{ " + dir_parameter + ".files }}" -%}}
{{%- set lineinfile_when = dir_parameter + ".matched" -%}}
{{%- set new_line = parameter + separator + value -%}}
- name: '{{{ msg or rule_title }}}'
block:
- {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True, escape_regex=True)|indent }}}
- {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1', escape_regex=True)|indent }}}
+ {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True)|indent }}}
+ {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1')|indent }}}
{{{ ansible_stat("Check if " + config_dir + " exists", path=config_dir, register=dir_exists)|indent }}}
{{{ ansible_find("Check if the parameter " + parameter + " is present in " + config_dir, paths=config_dir, contains=line_regex, register=dir_parameter, when=find_when)|indent }}}
- {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when, escape_regex=True)|indent }}}
- {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before, escape_regex=True)|indent }}}
+ {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when)|indent }}}
+ {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before)|indent }}}
{{%- endmacro %}}
{{#
From c29550ef26fc283ce5e72038fddf70aa716f4d1c Mon Sep 17 00:00:00 2001
From: Matthew Burket <mburket@redhat.com>
Date: Thu, 4 Nov 2021 08:53:42 -0500
Subject: [PATCH 5/5] Fix ansible-lint lint issues
---
shared/macros-ansible.jinja | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
index 8e7ce1a1206..76f05e76b88 100644
--- a/shared/macros-ansible.jinja
+++ b/shared/macros-ansible.jinja
@@ -136,7 +136,7 @@ value: "Setting={{ varname1 }}"
{{%- set var_dir = config_dir | replace("/", "_") | replace("-", "_") | replace(".", "_") -%}}
{{%- set dir_exists = var_dir + "_exists" -%}}
{{%- set dir_parameter = var_dir + "_has_parameter" -%}}
-{{%- set line_regex = prefix_regex + "{{\"" + parameter + "\"| regex_escape }}" + separator_regex -%}}
+{{%- set line_regex = prefix_regex + "{{ \"" + parameter + "\"| regex_escape }}" + separator_regex -%}}
{{%- set find_when = dir_exists + ".stat.isdir is defined and " + dir_exists + ".stat.isdir" -%}}
{{%- set lineinfile_items = "{{ " + dir_parameter + ".files }}" -%}}
{{%- set lineinfile_when = dir_parameter + ".matched" -%}}