Fix non-skippable ansible-lint certification findings in generated Ansible content

.config/ansible-lint.yml

@@ -1,22 +1,56 @@
+---
+# Ansible-lint configuration aligned with the Red Hat Automation Hub partner
+# certification requirements:
+#   https://docs.ansible.com/projects/partner-certification-requirements/static-analysis/
+#
+# Certification runs the "production" profile. A fixed set of rules "cannot be
+# skipped" and must stay enforced; every other rule listed there is allowed to
+# be skipped for machine-generated collections past version 1.0.0. This config
+# therefore skips only the allowed rules and leaves the non-skippable ones
+# active, so that `ansible-lint` run bare (auto-discovering this file) against
+# the generated Ansible roles reports exactly the certification backlog.
+#
+# NOTE: content's own CI lints generated playbooks with an explicit
+# `-c tests/ansible-lint_config.yml` (see cmake/SSGCommon.cmake), so this file
+# does NOT change that gate; it is picked up only by bare `ansible-lint` runs,
+# i.e. when measuring the generated collection against the certification bar.
+profile: production
+
+exclude_paths:
+  - changelogs
+  - .ansible
+  - .github
+
+# Rules the certification explicitly allows to be skipped. SCAP variable names
+# are not role-prefixed and do not follow Ansible's var naming pattern; yamllint
+# is run separately upstream; the generated set_fact/command tasks use free-form.
 skip_list:
-    - fqcn-builtins # We should be using fqcn
-    - key-order[task]
-    - no-free-form
-    - risky-file-permissions
-    - no-changed-when
-    - var-naming
-    - ignore-errors
-    - schema[meta]
-    - yaml[indentation]  # Violations reported by yamllint.
-    - jinja[spacing]  # Rule that looks inside jinja2 templates.
-    - name[template]  # Rule for checking task and play names.
-    - fqcn[action]  # Use FQCN for builtin actions.
+  - yaml                        # yamllint is run separately upstream
+  - no-free-form               # generated set_fact/command use free-form
+  - jinja[spacing]
+  - key-order[task]
+  - fqcn[action-core]
+  - name[template]
+  - no-tabs
+  - var-naming[no-role-prefix] # SCAP variable names are not role-prefixed
+  - var-naming[pattern]        # SCAP variable names
+  - ignore-errors
+  # A handful of remediations must call a binary directly because no Ansible
+  # module provides the behavior: `service auditd restart` (auditd sets
+  # RefuseManualStop=yes, so the service/systemd modules cannot restart it),
+  # and `rpm -Va`/`rpm -qf`/`rpm -qV`/`rpm --restore`/`rpm --setperms`/
+  # `rpm --setugids` (the package module has no verify/query-owner/restore
+  # semantics). These tasks carry an inline `# noqa command-instead-of-module`
+  # in the rule source playbooks, but the build re-serializes YAML and strips
+  # comments before the collection is assembled, so a global skip is required.
+  - command-instead-of-module
 
+# Required by the certification to be set to warn (not skip).
 warn_list:
-    - name[missing]  # Rule for checking task and play names.
-    - template-instead-of-copy  # Templated files should use template instead of copy
-    - yaml[empty-lines]  # Violations reported by yamllint.
-    - yaml[line-length]  # Violations reported by yamllint.
-    - name[casing]  # Rule for checking task and play names.
-    - no-handler # Style choice, skipping for now
-    - risky-shell-pipe # Skipping for now due to authselect rules
+  - no-log-password
+
+# Rules that "cannot be skipped" per the certification and are intentionally
+# NOT in skip_list -- these constitute the remediation backlog:
+#   risky-shell-pipe, command-instead-of-shell, meta-no-info, package-latest,
+#   no-handler, meta-runtime[unsupported-version], no-changed-when,
+#   risky-file-permissions, unnamed-task

.github/workflows/gate-lint-ansible-roles.yaml

@@ -30,4 +30,4 @@ jobs:
       - name: Set git safe directory
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
       - name: Lint Ansible Roles
-        run: ansible-lint -x 204 -x experimental -x command-instead-of-module ./build/ansible_roles/*
+        run: ansible-lint -x 204 -x experimental ./build/ansible_roles/*

linux_os/guide/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_faillock/ansible/rhel9.yml

@@ -49,7 +49,10 @@
   register: auditctl_faillock_update_result
   with_items: "{{ faillock_audit_rules }}"
 
-- name: "{{{ rule_title }}} - Restart auditd"
+# noqa command-instead-of-module: auditd sets RefuseManualStop=yes, so the service/systemd
+# modules cannot restart it; the SysV 'service auditd restart' wrapper is the supported method.
+- name: "{{{ rule_title }}} - Restart auditd"  # noqa: command-instead-of-module
   ansible.builtin.command: /usr/sbin/service auditd restart
+  changed_when: true
   when:
     - augenrules_faillock_update_result is changed or auditctl_faillock_update_result is changed

linux_os/guide/auditing/auditd_configure_rules/audit_login_events/audit_rules_login_events_lastlog/ansible/rhel9.yml

@@ -47,7 +47,10 @@
   register: auditctl_lastlog_update_result
   with_items: "{{ lastlog_audit_rules }}"
 
-- name: "{{{ rule_title }}} - Restart auditd"
+# noqa command-instead-of-module: auditd sets RefuseManualStop=yes, so the service/systemd
+# modules cannot restart it; the SysV 'service auditd restart' wrapper is the supported method.
+- name: "{{{ rule_title }}} - Restart auditd"  # noqa: command-instead-of-module
   ansible.builtin.command: /usr/sbin/service auditd restart
+  changed_when: true
   when:
     - augenrules_lastlog_update_result is changed or auditctl_lastlog_update_result is changed

linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml

@@ -64,8 +64,11 @@
   register: auditctl_audit_rules_privilege_function_update_result
   with_items: "{{ suid_audit_rules }}"
 # restarting auditd through systemd doesn't work, see: https://access.redhat.com/solutions/5515011
-- name: Restart Auditd
+# noqa command-instead-of-module: auditd sets RefuseManualStop=yes, so the service/systemd
+# modules cannot restart it; the SysV 'service auditd restart' wrapper is the supported method.
+- name: Restart Auditd  # noqa: command-instead-of-module
   ansible.builtin.command: /usr/sbin/service auditd restart
+  changed_when: true
   when:
     - (augenrules_audit_rules_privilege_function_update_result.changed or
        auditctl_audit_rules_privilege_function_update_result.changed)

linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/ansible/shared.yml

@@ -63,8 +63,11 @@
     name: auditd.service
     state: restarted
 {{%- else %}} # restarting auditd through systemd doesn't work, see: https://access.redhat.com/solutions/5515011
-- name: Restart Auditd
+# noqa command-instead-of-module: auditd sets RefuseManualStop=yes, so the service/systemd
+# modules cannot restart it; the SysV 'service auditd restart' wrapper is the supported method.
+- name: Restart Auditd  # noqa: command-instead-of-module
   ansible.builtin.command: /usr/sbin/service auditd restart
+  changed_when: true
 {{%- endif %}}
   when:
     - augenrules_audit_rules_privilege_function_update_result.changed or

linux_os/guide/auditing/auditd_configure_rules/file_permissions_audit_configuration_stig/ansible/shared.yml

@@ -66,8 +66,11 @@
         daemon_reload: true
 
     # IMPORTANT: this is necessary to ensure the dropin is loaded and the permissions for /etc/audit/ and /etc/audit/rules.d/ files are set correctly.
-    - name: "{{{ rule_title }}} - Restart auditd.service"
+    # noqa command-instead-of-module: auditd sets RefuseManualStop=yes, so the service/systemd
+    # modules cannot restart it; the SysV 'service auditd restart' wrapper is the supported method.
+    - name: "{{{ rule_title }}} - Restart auditd.service"  # noqa: command-instead-of-module
       ansible.builtin.command: service auditd restart
+      changed_when: true
       when:
         - audit_config_perms.changed or rules_dir_perms.changed
 

linux_os/guide/services/cron_and_at/file_permissions_cron_not_modified/ansible/shared.yml

@@ -4,18 +4,20 @@
 # complexity = low
 # disruption = low
 
-- name: "{{{ rule_title }}} - Restore ownership of cronie files"
+# noqa command-instead-of-module: the package module cannot restore RPM-owned file ownership
+# or permissions (rpm --setugids / --setperms); rpm must be invoked directly.
+- name: "{{{ rule_title }}} - Restore ownership of cronie files"  # noqa: command-instead-of-module
   ansible.builtin.command: rpm --setugids cronie
   changed_when: true
 
-- name: "{{{ rule_title }}} - Restore permissions of cronie files"
+- name: "{{{ rule_title }}} - Restore permissions of cronie files"  # noqa: command-instead-of-module
   ansible.builtin.command: rpm --setperms cronie
   changed_when: true
 
-- name: "{{{ rule_title }}} - Restore ownership of crontabs files"
+- name: "{{{ rule_title }}} - Restore ownership of crontabs files"  # noqa: command-instead-of-module
   ansible.builtin.command: rpm --setugids crontabs
   changed_when: true
 
-- name: "{{{ rule_title }}} - Restore permissions of crontabs files"
+- name: "{{{ rule_title }}} - Restore permissions of crontabs files"  # noqa: command-instead-of-module
   ansible.builtin.command: rpm --setperms crontabs
   changed_when: true

linux_os/guide/services/mail/postfix_client/postfix_client_configure_mail_alias/ansible/shared.yml

@@ -23,6 +23,7 @@
 - name: {{{ rule_title }}} - Update postfix aliases
   ansible.builtin.command:
     cmd: newaliases
+  changed_when: true
   when:
     - aliases_root_mail_alias_changed is changed
     - result_newaliases_present.stat.exists

linux_os/guide/services/mail/postfix_client/postfix_client_configure_mail_alias_postmaster/ansible/shared.yml

@@ -21,6 +21,7 @@
 - name: {{{ rule_title }}} - Update postfix aliases
   ansible.builtin.command:
     cmd: newaliases
+  changed_when: true
   when:
     - result_newaliases_present.stat.exists
     - aliases_postmaster_changed is changed

linux_os/guide/services/ntp/chronyd_specify_remote_server/ansible/shared.yml

@@ -14,7 +14,9 @@
 
 - name: "Extract sourcedir paths from chrony configuration"
   ansible.builtin.shell:
-    cmd: grep '^[[:space:]]*sourcedir[[:space:]]\+' {{{ chrony_conf_path }}} | awk '{print $2}'
+    cmd: |-
+      set -o pipefail
+      grep '^[[:space:]]*sourcedir[[:space:]]\+' {{{ chrony_conf_path }}} | awk '{print $2}'
   register: chrony_sourcedir_paths
   changed_when: false
   failed_when: false
@@ -25,7 +27,7 @@
     cmd: |
       for dir in {{ chrony_sourcedir_paths.stdout_lines | join(' ') }}; do
         if [ -d "$dir" ]; then
-          grep -q '^[[:space:]]*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' "$dir"/*.sources 2>/dev/null && exit 0
+          grep -q -e '^[[:space:]]*server[[:space:]]\+[[:graph:]]\+' -e '^[[:space:]]*pool[[:space:]]\+[[:graph:]]\+' "$dir"/*.sources 2>/dev/null && exit 0
         fi
       done
       exit 1
@@ -38,7 +40,9 @@
 
 - name: "Extract confdir paths from chrony configuration"
   ansible.builtin.shell:
-    cmd: grep '^[[:space:]]*confdir[[:space:]]\+' {{{ chrony_conf_path }}} | awk '{print $2}'
+    cmd: |-
+      set -o pipefail
+      grep '^[[:space:]]*confdir[[:space:]]\+' {{{ chrony_conf_path }}} | awk '{print $2}'
   register: chrony_confdir_paths
   changed_when: false
   failed_when: false
@@ -51,7 +55,7 @@
     cmd: |
       for dir in {{ chrony_confdir_paths.stdout_lines | join(' ') }}; do
         if [ -d "$dir" ]; then
-          grep -q '^[[:space:]]*\(server\|pool\)[[:space:]]\+[[:graph:]]\+' "$dir"/*.conf 2>/dev/null && exit 0
+          grep -q -e '^[[:space:]]*server[[:space:]]\+[[:graph:]]\+' -e '^[[:space:]]*pool[[:space:]]\+[[:graph:]]\+' "$dir"/*.conf 2>/dev/null && exit 0
         fi
       done
       exit 1

linux_os/guide/services/ssh/ssh_server/firewalld_sshd_port_enabled/ansible/shared.yml

@@ -22,15 +22,19 @@
   block:
     - name: '{{{ rule_title }}} - Collect NetworkManager connections names'
       ansible.builtin.shell:
-        cmd: nmcli -g UUID,TYPE con | grep -v loopback | awk -F ':' '{ print $1 }'
+        cmd: |-
+          set -o pipefail
+          nmcli -g UUID,TYPE con | grep -v loopback | awk -F ':' '{ print $1 }'
       register: result_nmcli_cmd_connections_names
       check_mode: false
       changed_when: false
       failed_when: false
 
     - name: '{{{ rule_title }}} - Collect NetworkManager connections zones'
       ansible.builtin.shell:
-        cmd: nmcli -f connection.zone connection show {{ item | trim }} | awk '{ print $2}'
+        cmd: |-
+          set -o pipefail
+          nmcli -f connection.zone connection show {{ item | trim }} | awk '{ print $2}'
       register: result_nmcli_cmd_connections_zones
       changed_when: false
       failed_when: false
@@ -65,7 +69,9 @@
 
     - name: '{{{ rule_title }}} - Collect firewalld active zones'
       ansible.builtin.shell:
-        cmd: firewall-cmd --get-active-zones | grep -v "^ " | cut -d " " -f 1
+        cmd: |-
+          set -o pipefail
+          firewall-cmd --get-active-zones | grep -v "^ " | cut -d " " -f 1
       register: result_firewall_cmd_zones_names
       changed_when: false
       failed_when: false

linux_os/guide/services/usbguard/usbguard_generate_policy/ansible/shared.yml

@@ -20,6 +20,7 @@
   - name: Create USBGuard Policy configuration
     ansible.builtin.command: usbguard generate-policy
     register: policy
+    changed_when: true
     when: not policy_file.stat.exists or policy_file.stat.size == 0
 
   - name: Copy the Generated Policy configuration to a persistent file

linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_banner_enabled/ansible/shared.yml

@@ -25,4 +25,5 @@
 
 - name: Dconf Update
   ansible.builtin.command: dconf update
+  changed_when: true
   when: result_ini is changed or result_lineinfile is changed

linux_os/guide/system/accounts/accounts-banners/gui_login_banner/dconf_gnome_login_banner_text/ansible/shared.yml

@@ -50,4 +50,5 @@
 
 - name: Dconf Update
   ansible.builtin.command: dconf update
+  changed_when: true
   when: result_ini is changed or result_lineinfile is changed

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/account_password_selinux_faillock_dir/ansible/shared.yml

@@ -6,10 +6,12 @@
 
 - name: {{{ rule_title }}} - Get directories from faillock
   ansible.builtin.shell: |-
+    set -o pipefail
     grep -oP '^\s*(?:auth.*pam_faillock.so.*)?dir\s*=\s*(\S+)' "{{ item }}" | sed -r 's/.*=\s*(\S+)/\1/'
   register: faillock_output
   changed_when: false
   check_mode: false
+  failed_when: false
   with_items:
     - /etc/security/faillock.conf
     {{% if 'ol' not in families %}}
@@ -42,6 +44,7 @@
     if ! semanage fcontext -a -t faillog_t "{{ item.item }}(/.*)?"; then
       semanage fcontext -m -t faillog_t "{{ item.item }}(/.*)?"
     fi
+  changed_when: true
   with_items: "{{ faillock_selinux_context.results }}"
   when:
     - item.item != ""
@@ -50,6 +53,7 @@
 
 - name: {{{ rule_title }}} - Restore SELinux context
   ansible.builtin.command: restorecon -R -v "{{ item.item }}"
+  changed_when: true
   with_items: "{{ faillock_selinux_context.results }}"
   when:
     - item.item != ""

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_password_pam_pwhistory_use_authtok/ansible/shared.yml

@@ -15,7 +15,9 @@
 
 - name: '{{{ rule_title }}} - Get authselect current profile'
   ansible.builtin.shell:
-    cmd: authselect current -r | awk '{ print $1 }'
+    cmd: |-
+      set -o pipefail
+      authselect current -r | awk '{ print $1 }'
   register: result_authselect_profile
   changed_when: false
   when:

linux_os/guide/system/accounts/accounts-pam/locking_out_password_attempts/accounts_passwords_pam_faillock_dir/ansible/shared.yml

@@ -44,4 +44,5 @@
   ansible.builtin.command:
     cmd: restorecon -R "{{ var_accounts_passwords_pam_faillock_dir }}"
   register: result_accounts_passwords_pam_faillock_dir_restorecon
+  changed_when: true
   when: '"faillog_t" not in faillock_selinux_context.stdout'

linux_os/guide/system/accounts/accounts-physical/grub2_disable_interactive_boot/ansible/shared.yml

@@ -25,8 +25,10 @@
 {{% else %}}
   ansible.builtin.command: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
 {{% endif %}}
+  changed_when: true
   when: grub_confirm_spawn_changed is changed
 
 - name: {{{ rule_title }}} - Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY and confirm_spawn
   ansible.builtin.command: grub2-mkconfig -o  {{{ grub2_boot_path }}}/grub.cfg
+  changed_when: true
   when: grub_disable_recovery_changed is changed or grub_confirm_spawn_changed is changed

linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_card_drivers/ansible/shared.yml

@@ -24,6 +24,7 @@
     - name: "{{{ rule_title }}}"
       ansible.builtin.command: |
         /usr/bin/opensc-tool -S app:default:card_drivers:{{ var_smartcard_drivers }}
+      changed_when: true
       when:
         - card_drivers.stdout != var_smartcard_drivers
   when:

linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/configure_opensc_nss_db/ansible/shared.yml

@@ -15,5 +15,7 @@
   when: pkcs11switch.stat.exists
 
 - name: "{{{ rule_title }}} - Select opensc Module"
-  ansible.builtin.shell: echo -e "\n" | /usr/bin/pkcs11-switch opensc
+  ansible.builtin.shell: |-
+    set -o pipefail
+    echo -e "\n" | /usr/bin/pkcs11-switch opensc
   when: pkcs11switch.stat.exists and pkcsw_output.stdout != "opensc"

linux_os/guide/system/accounts/accounts-physical/screen_locking/smart_card_login/force_opensc_card_drivers/ansible/shared.yml

@@ -24,6 +24,7 @@
     - name: "{{{ rule_title }}}"
       ansible.builtin.command: |
         /usr/bin/opensc-tool -S app:default:force_card_driver:{{ var_smartcard_drivers }}
+      changed_when: true
       when:
         - force_card_driver.stdout != var_smartcard_drivers
   when:

linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_min_life_existing/ansible/shared.yml

@@ -21,5 +21,6 @@
   ansible.builtin.command: >
     chage -m {{ var_accounts_minimum_age_login_defs }} {{ item }}
 {{% endif %}}
+  changed_when: true
   with_items: "{{ user_names.stdout_lines }}"
   when: user_names.stdout_lines | length > 0

linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_password_set_warn_age_existing/ansible/shared.yml

@@ -15,5 +15,6 @@
 - name: {{{ rule_title }}} - Ensure the Number of Days of Warning Before Password Expires
   ansible.builtin.command:
     cmd: chage --warndays {{ var_accounts_password_warn_age_login_defs }} {{ item }}
+  changed_when: true
   with_items: '{{ result_pass_warn_age_user_names.stdout_lines }}'
   when: result_pass_warn_age_user_names is not skipped and result_pass_warn_age_user_names.stdout_lines | length > 0

linux_os/guide/system/accounts/accounts-restrictions/password_expiration/accounts_set_post_pw_existing/ansible/shared.yml

@@ -15,5 +15,6 @@
 - name: Change the period of inactivity
   ansible.builtin.command:
     cmd: chage --inactive {{ var_account_disable_post_pw_expiration }} {{ item }}
+  changed_when: true
   with_items: '{{ user_names.stdout_lines }}'
   when: user_names is not skipped and user_names.stdout_lines | length > 0

linux_os/guide/system/accounts/accounts-restrictions/password_storage/no_empty_passwords_etc_shadow/ansible/shared.yml

@@ -13,5 +13,6 @@
 - name: Lock users with no password
   ansible.builtin.command: >
     passwd -l {{ item }}
+  changed_when: true
   with_items: "{{ users_nopasswd.stdout_lines }}"
   when: users_nopasswd is not skipped and users_nopasswd.stdout_lines | length > 0

linux_os/guide/system/accounts/accounts-restrictions/root_logins/accounts_no_uid_except_zero/ansible/shared.yml

@@ -11,5 +11,6 @@
 
 - name: Lock the password of the user accounts other than root with uid 0
   ansible.builtin.command: passwd -l {{ item.key }}
+  changed_when: true
   loop: "{{ getent_passwd | dict2items | rejectattr('key', 'equalto', 'root') | list }}"
   when: item.value.1  == '0'