Bug 2105162

Hello, I have just tested this on a fully updated RHEL 9 system (deployed from qcow) and it does not work unless you export the ANSIBLE_COLLECTIONS PATH:

[root@rhel90 ansible]# ANSIBLE_COLLECTIONS_PATH=/usr/share/rhc-worker-playbook/ansible/collections/ansible_collections/

[root@rhel90 ansible]#  ansible-playbook -i localhost -c local rhel9-playbook-cis_server_l1.yml 
[WARNING]: Unable to parse /usr/share/scap-security-guide/ansible/localhost as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match
'all'
ERROR! couldn't resolve module/action 'ini_file'. This often indicates a misspelling, missing collection, or incorrect module path.

The error appears to be in '/usr/share/scap-security-guide/ansible/rhel9-playbook-cis_server_l1.yml': line 340, column 7, but may
be elsewhere in the file depending on the exact syntax problem.

The offending line appears to be:


    - name: Ensure GPG check is globally activated
      ^ here
[root@rhel90 ansible]# 

All that needs to change from the above is the following line to include "export"
[root@rhel90 ansible]# ANSIBLE_COLLECTIONS_PATH=/usr/share/rhc-worker-playbook/ansible/collections/ansible_collections/

Package versions:
openscap-1.3.6-3.el9.x86_64
openscap-scanner-1.3.6-3.el9.x86_64
scap-security-guide-0.1.60-6.el9_0.noarch
ansible-core-2.12.2-1.el9.x86_64
rhc-worker-playbook-0.1.8-1.el9.x86_64

After the correction I have encountered an issue that appears to be with the playbook or my deployment, rather than Ansible module inclusions:

TASK [Check the integrity of the current authselect profile] ************************************************************
fatal: [localhost]: FAILED! => {"changed": false, "cmd": ["authselect", "check"], "delta": "0:00:00.012932", "end": "2022-08-03 21:44:42.908747", "msg": "non-zero return code", "rc": 2, "start": "2022-08-03 21:44:42.895815", "stderr": "", "stderr_lines": [], "stdout": "System was not configured with authselect.", "stdout_lines": ["System was not configured with authselect."]}
...ignoring

TASK [Informative message based on the authselect integrity check result] ***********************************************
fatal: [localhost]: FAILED! => {
    "assertion": "result_authselect_check_cmd is success",
    "changed": false,
    "evaluated_to": false,
    "msg": [
        "authselect integrity check failed. Remediation aborted!",
        "This remediation could not be applied because the authselect profile is not intact.",
        "It is not recommended to manually edit the PAM files when authselect is available.",
        "In cases where the default authselect profile does not cover a specific demand, a custom authselect profile is recommended."
    ]
}

Happy to collect more info as needed.

Please note that later error with authselect in the previous comment was due to an issue with my authselect configuration, which has nothing to do with this BZ.

You don't have to use the environment variable.  You can also use an ansible config setting https://docs.ansible.com/ansible/latest/reference_appendices/config.html#collections-paths in various places: https://docs.ansible.com/ansible/latest/reference_appendices/config.html#the-configuration-file

This release note has been published in 9.0: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html-single/9.0_release_notes/index

Issue migration from Bugzilla to Jira is in process at this time. This will be the last message in Jira copied from the Bugzilla bug.

This BZ has been automatically migrated to the issues.redhat.com Red Hat Issue Tracker. All future work related to this report will be managed there.

To find the migrated issue, look in the "Links" section for a direct link to the new issue location. The issue key will have an icon of 2 footprints next to it, and begin with "RHEL-" followed by an integer.  You can also find this issue by visiting https://issues.redhat.com/issues/?jql= and searching the "Bugzilla Bug" field for this BZ's number, e.g. a search like:

"Bugzilla Bug" = 1234567

In the event you have trouble locating or viewing this issue, you can file an issue by sending mail to rh-issues.