Avoid skipped package-related tasks

This patch splits up the tasks from packages.yml into the specific
package manager task files. This should avoid some skipped tasks
during playbook runs.

Change-Id: I7baab85abbcd91f72e1f104d45df53f540b756d0

tasks/rhel7stig/apt.yml

@@ -90,3 +90,30 @@
   tags:
     - high
     - V-71979
+
+- name: V-71987 - Clean requirements/dependencies when removing packages (dpkg)
+  lineinfile:
+    dest: /etc/apt/apt.conf.d/security-autoremove
+    regexp: "^(#)?APT::Get::AutomaticRemove"
+    line: "APT{{ '::' }}Get{{ '::' }}AutomaticRemove \"0\";"
+    state: present
+    create: yes
+  when:
+    - security_package_clean_on_remove | bool
+    - ansible_os_family | lower == 'debian'
+  tags:
+    - low
+    - packages
+    - V-71987
+
+- name: Enable automatic package updates (apt)
+  copy:
+    src: 20auto-upgrades
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+  when:
+    - ansible_os_family | lower == 'debian'
+    - security_rhel7_automatic_package_updates | bool
+  tags:
+    - packages
+    - cat2
+    - V-71999

tasks/rhel7stig/dnf.yml

@@ -1 +0,0 @@
-yum.yml

tasks/rhel7stig/dnf.yml

@@ -0,0 +1,58 @@
+---
+# Copyright 2017, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- include: rpm.yml
+
+- name: Check if /etc/dnf/automatic.conf exists
+  stat:
+    path: /etc/dnf/automatic.conf
+  check_mode: no
+  register: dnf_automatic_config_check
+  when:
+    - ansible_os_family | lower == 'redhat'
+    - ansible_pkg_mgr == 'dnf'
+  tags:
+    - always
+
+- name: Enable automatic package updates (dnf)
+  lineinfile:
+    dest: /etc/dnf/automatic.conf
+    regexp: "^apply_updates"
+    line: "apply_updates = yes"
+    state: present
+  when:
+    - ansible_os_family | lower == 'redhat'
+    - ansible_pkg_mgr == 'dnf'
+    - dnf_automatic_config_check.stat.exists | bool
+    - security_rhel7_automatic_package_updates | bool
+  tags:
+    - packages
+    - medium
+    - V-71999
+
+- name: Enable dnf-automatic timer for automatic package updates
+  systemd:
+    name: dnf-automatic.timer
+    enabled: yes
+    state: started
+  when:
+    - ansible_os_family | lower == 'redhat'
+    - ansible_pkg_mgr == 'dnf'
+    - dnf_automatic_config_check.stat.exists | bool
+    - security_rhel7_automatic_package_updates | bool
+  tags:
+    - packages
+    - medium
+    - V-71999

tasks/rhel7stig/packages.yml

@@ -33,139 +33,3 @@
     - V-72233
     - V-72301
     - V-72307
-
-- name: V-71987 - Clean requirements/dependencies when removing packages (RedHat)
-  lineinfile:
-    dest: "{{ pkg_mgr_config }}"
-    regexp: "^(#)?clean_requirements_on_remove"
-    line: "clean_requirements_on_remove=1"
-    state: present
-  when:
-    - security_package_clean_on_remove | bool
-    - ansible_os_family | lower == 'redhat'
-  tags:
-    - low
-    - packages
-    - V-71987
-
-- name: V-71987 - Clean requirements/dependencies when removing packages (SUSE)
-  lineinfile:
-    dest: "{{ pkg_mgr_config }}"
-    regexp: '^(#)?\s*solver\.cleandepsOnRemove'
-    line: 'solver.cleandepsOnRemove = true'
-    state: present
-  when:
-    - security_package_clean_on_remove | bool
-    - ansible_pkg_mgr == 'zypper'
-  tags:
-    - low
-    - packages
-    - V-71987
-
-- name: V-71987 - Clean requirements/dependencies when removing packages (dpkg)
-  lineinfile:
-    dest: /etc/apt/apt.conf.d/security-autoremove
-    regexp: "^(#)?APT::Get::AutomaticRemove"
-    line: "APT{{ '::' }}Get{{ '::' }}AutomaticRemove \"0\";"
-    state: present
-    create: yes
-  when:
-    - security_package_clean_on_remove | bool
-    - ansible_os_family | lower == 'debian'
-  tags:
-    - low
-    - packages
-    - V-71987
-
-- name: Check if /etc/yum/yum-cron.conf exists
-  stat:
-    path: /etc/yum/yum-cron.conf
-  check_mode: no
-  register: yum_cron_config_check
-  when:
-    - ansible_os_family | lower == 'redhat'
-    - ansible_pkg_mgr == 'yum'
-  tags:
-    - always
-
-- name: Enable automatic package updates (yum)
-  lineinfile:
-    dest: /etc/yum/yum-cron.conf
-    regexp: "^apply_updates"
-    line: "apply_updates = yes"
-    state: present
-  when:
-    - ansible_os_family | lower == 'redhat'
-    - ansible_pkg_mgr == 'yum'
-    - yum_cron_config_check.stat.exists | bool
-    - security_rhel7_automatic_package_updates | bool
-  tags:
-    - packages
-    - medium
-    - V-71999
-
-- name: Check if /etc/dnf/automatic.conf exists
-  stat:
-    path: /etc/dnf/automatic.conf
-  check_mode: no
-  register: dnf_automatic_config_check
-  when:
-    - ansible_os_family | lower == 'redhat'
-    - ansible_pkg_mgr == 'dnf'
-  tags:
-    - always
-
-- name: Enable automatic package updates (dnf)
-  lineinfile:
-    dest: /etc/dnf/automatic.conf
-    regexp: "^apply_updates"
-    line: "apply_updates = yes"
-    state: present
-  when:
-    - ansible_os_family | lower == 'redhat'
-    - ansible_pkg_mgr == 'dnf'
-    - dnf_automatic_config_check.stat.exists | bool
-    - security_rhel7_automatic_package_updates | bool
-  tags:
-    - packages
-    - medium
-    - V-71999
-
-- name: Enable dnf-automatic timer for automatic package updates
-  systemd:
-    name: dnf-automatic.timer
-    enabled: yes
-    state: started
-  when:
-    - ansible_os_family | lower == 'redhat'
-    - ansible_pkg_mgr == 'dnf'
-    - dnf_automatic_config_check.stat.exists | bool
-    - security_rhel7_automatic_package_updates | bool
-  tags:
-    - packages
-    - medium
-    - V-71999
-
-- name: Enable automatic package updates (apt)
-  copy:
-    src: 20auto-upgrades
-    dest: /etc/apt/apt.conf.d/20auto-upgrades
-  when:
-    - ansible_os_family | lower == 'debian'
-    - security_rhel7_automatic_package_updates | bool
-  tags:
-    - packages
-    - cat2
-    - V-71999
-
-- name: Enable automatic package updates (SUSE)
-  copy:
-    src: zypper-autoupdates
-    dest: /etc/cron.daily/zypper-autoupdates
-  when:
-    - ansible_pkg_mgr == 'zypper'
-    - security_rhel7_automatic_package_updates | bool
-  tags:
-    - packages
-    - cat2
-    - V-71999

tasks/rhel7stig/rpm.yml

@@ -0,0 +1,85 @@
+---
+# Copyright 2016, Rackspace US, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+- name: Ensure RPM verification task has finished
+  async_status:
+    jid: "{{ rpmverify_task.ansible_job_id }}"
+  failed_when: False
+  changed_when: False
+  register: job_result
+  until: job_result.finished
+  retries: 30
+  when:
+    - not rpmverify_task | skipped
+
+- name: V-71855 - Get files with invalid checksums (rpm)
+  shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'"
+  register: invalid_checksum_files
+  changed_when: False
+  when:
+    - not check_mode | bool
+    - ansible_os_family | lower == 'redhat'
+  tags:
+    - rpm
+    - high
+    - V-71855
+
+- name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm)
+  debug:
+    msg: |
+      The following files have checksums that differ from the checksum provided
+      with their package. Each of these should be verified manually to ensure
+      they have not been modified by an unauthorized user.
+
+      {% for filename in invalid_checksum_files.stdout_lines %}
+        {{ filename }}
+      {% endfor %}
+  when:
+    - not check_mode | bool
+    - ansible_os_family | lower == 'redhat'
+    - invalid_checksum_files is defined
+    - invalid_checksum_files.stdout is defined
+  tags:
+    - rpm
+    - high
+    - V-71855
+
+- name: V-71977 - Require digital signatures for all packages
+  lineinfile:
+    dest: "{{ pkg_mgr_config }}"
+    regexp: "{{ item.regexp }}"
+    line: "{{ item.line }}"
+    state: present
+  with_items: "{{ rpm_gpgchecks | default([]) }}"
+  tags:
+    - rpm
+    - high
+    - V-71977
+    - V-71979
+    - V-71981
+
+- name: V-71987 - Clean requirements/dependencies when removing packages (RedHat)
+  lineinfile:
+    dest: "{{ pkg_mgr_config }}"
+    regexp: "^(#)?clean_requirements_on_remove"
+    line: "clean_requirements_on_remove=1"
+    state: present
+  when:
+    - security_package_clean_on_remove | bool
+    - ansible_os_family | lower == 'redhat'
+  tags:
+    - low
+    - packages
+    - V-71987

tasks/rhel7stig/yum.yml

@@ -1,5 +1,5 @@
 ---
-# Copyright 2016, Rackspace US, Inc.
+# Copyright 2017, Rackspace US, Inc.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -13,59 +13,29 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-- name: Ensure RPM verification task has finished
+- include: rpm.yml
-  async_status:
-    jid: "{{ rpmverify_task.ansible_job_id }}"
-  failed_when: False
-  changed_when: False
-  register: job_result
-  until: job_result.finished
-  retries: 30
-  when:
-    - not rpmverify_task | skipped
 
-- name: V-71855 - Get files with invalid checksums (rpm)
+- name: Check if /etc/yum/yum-cron.conf exists
-  shell: "grep '^..5' {{ temp_dir }}/rpmverify.txt | awk '{ print $NF }'"
+  stat:
-  register: invalid_checksum_files
+    path: /etc/yum/yum-cron.conf
-  changed_when: False
+  check_mode: no
+  register: yum_cron_config_check
   when:
-    - not check_mode | bool
     - ansible_os_family | lower == 'redhat'
   tags:
-    - rpm
+    - always
-    - high
-    - V-71855
 
-- name: V-71855 - The cryptographic hash of system files and commands must match vendor values (rpm)
+- name: Enable automatic package updates (yum)
-  debug:
-    msg: |
-      The following files have checksums that differ from the checksum provided
-      with their package. Each of these should be verified manually to ensure
-      they have not been modified by an unauthorized user.
-
-      {% for filename in invalid_checksum_files.stdout_lines %}
-        {{ filename }}
-      {% endfor %}
-  when:
-    - not check_mode | bool
-    - ansible_os_family | lower == 'redhat'
-    - invalid_checksum_files is defined
-    - invalid_checksum_files.stdout is defined
-  tags:
-    - rpm
-    - high
-    - V-71855
-
-- name: V-71977 - Require digital signatures for all packages
   lineinfile:
-    dest: "{{ pkg_mgr_config }}"
+    dest: /etc/yum/yum-cron.conf
-    regexp: "{{ item.regexp }}"
+    regexp: "^apply_updates"
-    line: "{{ item.line }}"
+    line: "apply_updates = yes"
     state: present
-  with_items: "{{ rpm_gpgchecks | default([]) }}"
+  when:
+    - ansible_os_family | lower == 'redhat'
+    - yum_cron_config_check.stat.exists | bool
+    - security_rhel7_automatic_package_updates | bool
   tags:
-    - rpm
+    - packages
-    - high
+    - medium
-    - V-71977
+    - V-71999
-    - V-71979
-    - V-71981

tasks/rhel7stig/zypper.yml

@@ -31,7 +31,6 @@
   changed_when: False
   when:
     - not check_mode | bool
-    - ansible_pkg_mgr == 'zypper'
   tags:
     - rpm
     - high
@@ -49,7 +48,6 @@
       {% endfor %}
   when:
     - not check_mode | bool
-    - ansible_pkg_mgr == 'zypper'
     - invalid_checksum_files is defined
     - invalid_checksum_files.stdout is defined
   tags:
@@ -77,3 +75,27 @@
     - V-71977
     - V-71979
     - V-71981
+
+- name: V-71987 - Clean requirements/dependencies when removing packages (SUSE)
+  lineinfile:
+    dest: "{{ pkg_mgr_config }}"
+    regexp: '^(#)?\s*solver\.cleandepsOnRemove'
+    line: 'solver.cleandepsOnRemove = true'
+    state: present
+  when:
+    - security_package_clean_on_remove | bool
+  tags:
+    - low
+    - packages
+    - V-71987
+
+- name: Enable automatic package updates (SUSE)
+  copy:
+    src: zypper-autoupdates
+    dest: /etc/cron.daily/zypper-autoupdates
+  when:
+    - security_rhel7_automatic_package_updates | bool
+  tags:
+    - packages
+    - cat2
+    - V-71999