Add a "don't fail on error" switch ?

[rgarrigue]

Hello

I just added this role as a deps for my role, ended up removing it since it's breaking my playbook, especially my "molecule test". Logs are below.

   TASK [dev-sec.os-hardening : change su-binary to only be accessible to user and group root] ***
    fatal: [molecule-docker-gitlab-amazonlinux-2017.03]: FAILED! => {"changed": false, "failed": true, "msg": "file (/bin/su) is absent, cannot continue", "path": "/bin/su", "state": "absent"}
    fatal: [molecule-docker-gitlab-amazonlinux-2017.09]: FAILED! => {"changed": false, "failed": true, "msg": "file (/bin/su) is absent, cannot continue", "path": "/bin/su", "state": "absent"}
    changed: [molecule-docker-gitlab-centos-7]

   TASK [dev-sec.os-hardening : change su-binary to only be accessible to user and group root] ***
    fatal: [molecule-docker-gitlab-amazonlinux-2017.03]: FAILED! => {"changed": false, "failed": true, "msg": "file (/bin/su) is absent, cannot continue", "path": "/bin/su", "state": "absent"}
    fatal: [molecule-docker-gitlab-amazonlinux-2017.09]: FAILED! => {"changed": false, "failed": true, "msg": "file (/bin/su) is absent, cannot continue", "path": "/bin/su", "state": "absent"}
    changed: [molecule-docker-gitlab-centos-7]

As for me, I wish those lineinfile / ownership / mod checks could be ignored if files are missing, hence no security trouble there.

[rndmh3ro]

Hey @rgarrigue, rather than ignoring errors, I'd like to fix those errors so they don't happen in the first place.

I guess this happens because /bin/su is a symlink to /usr/bin/su or some other path.
Can you tell me, what operating system you're using (if you're on aws, tell me the ami, or if you use docker, tell me the container) please?

[rgarrigue]

Hello I'm running your role against centos/systemd:latest and amazonlinux/amazonlinux:2017.09 and 2017.03. To reproduce pip install molecule molecule init role test cd test Add your role in meta/main.yml and molecule/default/requirements.yml (to be created python style) Add those dockers to molecule/default/molecule.yml molecule test Le sam. 7 oct. 2017 15:08, Sebastian Gumprich <notifications@github.com> a écrit :

Hey @rgarrigue <https://github.com/rgarrigue>, rather than ignoring errors, I'd like to fix those errors so they don't happen in the first place. I guess this happens because /bin/su is a symlink to /usr/bin/su or some other path. Can you tell me, what operating system you're using (if you're on aws, tell me the ami, or if you use docker, tell me the container) please? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#148 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AByQn-cfvD9RAQugc6R1JwB8g6YL7n57ks5sp3e2gaJpZM4Pwez9> .

-- Rémy GARRIGUE

[rgarrigue]

Hi there. Coming to this role again 2 years later, I see a forgotten issue.

This is no longer relevant to me. Can be closed as far as I'm concerned.

[rndmh3ro]

Sorry, yeah, totally forgot. :/

Thanks for remembering though!