Bug 1814988 - Applying foreman.scap role from Satellite on client system where DISA STIG Security Policy is applied locally fails.
Summary: Applying foreman.scap role from Satellite on client system where DISA STIG Se...
Keywords:
Status: NEW
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: SCAP Plugin
Version: 6.6.0
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact: Jameer Pathan
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2020-03-19 09:20 UTC by Krutika Kinge
Modified: 2023-08-11 11:06 UTC (History)
7 users (show)

Fixed In Version: ansiblerole-foreman_scap_client-0.1.0
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 29475 0 Normal Closed Replace script for gathering facts fom subscription-manager with python implemntation in ansible-foreman_scap_client 2021-02-19 11:56:06 UTC
Red Hat Issue Tracker SAT-19505 0 None None None 2023-08-11 11:06:05 UTC
Red Hat Knowledge Base (Solution) 4948911 0 None None None 2020-04-24 03:55:28 UTC

Description Krutika Kinge 2020-03-19 09:20:32 UTC
Description of problem:
After applying the Ansible Role for the DISA Stig for RHEL of OpenScap 0.1.48 (https://github.com/ComplianceAsCode/content/releases/download/v0.1.48/scap-security-guide-0.1.48.zip) to the client system locally when 'theforeman.foreman_scap_client' role is applied from Satellite server getting the following error:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
TASK [theforeman.foreman_scap_client : Set facts for rh certs] *****************

fatal: [test.example.com]: FAILED! =>
  msg: |-
    the field 'args' has an invalid value ({u'rh_consumer_private_key_path': u"{{ (rh_certs.stdout | from_json).get('rh_consumer_private_key_path')  }}", u'rh_consumer_cert_path': u"{{ (rh_certs.stdout | from_json).get('rh_consumer_cert_path') }}", u'rh_ca_cert_path': u"{{ (rh_certs.stdout | from_json).get('rh_ca_cert_path') }}"}), and could not be converted to an dict.The error was: No JSON object could be decoded
    The error appears to be in '/usr/share/ansible/roles/theforeman.foreman_scap_client/tasks/main.yml': line 21, column 3, but may
    be elsewhere in the file depending on the exact syntax problem.
    The offending line appears to be:

    - name: 'Set facts for rh certs'
      ^ here
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This ansible error seems to be a problem with: https://github.com/theforeman/ansible-foreman_scap_client
More specifically this commit has introduced this new task "Set facts for rh certs": https://github.com/theforeman/ansible-foreman_scap_client/commit/b2bf6c595363174935f94b0f479d27e8eb5690ba

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. Applied the ansible role DISA Stig for RHEL of OpenScap 0.1.48 (https://github.com/ComplianceAsCode/content/releases/download/v0.1.48/scap-security-guide-0.1.48.zip) to the client.
2. Executed theforeman.foreman_scap_client ansible role on the client

Actual results:
Role is failing with error.

Expected results:
it should get executed successfully.

Additional info:
It seems that the 'fapolicyd' service is causing the issue and not allowing the script to execute. After stopping the service, everything started working fine.

Comment 3 Ondřej Pražák 2020-03-19 12:18:58 UTC
Could you try whitelisting ruby in fapolicyd? It helped upstream:

https://community.theforeman.org/t/issue-running-theforeman-foreman-scap-client-on-rhel-8/17438

Comment 4 S.Schwiedel 2020-03-31 06:22:53 UTC
Whitelisting helps. 
There are 3 possible solutions:
- RedHat solves the issue by preventing ruby code in ansible roles to run python
- the openscap policy could whitelists ruby because the ruby script is from the openscap package
- the puppet-agent installer should whitelist ruby since puppet require ruby 

I prefer to  not use ruby code in ansible.

Comment 5 Ondřej Pražák 2020-04-06 06:16:41 UTC
Created redmine issue https://projects.theforeman.org/issues/29475 from this bug

Comment 7 Bryan Kearney 2020-11-05 12:06:18 UTC
Moving this bug to POST for triage into Satellite since the upstream issue https://projects.theforeman.org/issues/29475 has been resolved.

Comment 16 Adam Ruzicka 2023-08-11 11:05:25 UTC
Moving back to new for reevaluation


Note You need to log in before you can comment on or make changes to this bug.