Consistently access facts via the ansible_facts.* namespace (#917)

* ci: disable injecting facts as own vars in the main namespace

Signed-off-by: Norman Ziegner <[email protected]>

* Consistently access facts via the ansible_facts.* namespace

Signed-off-by: Norman Ziegner <[email protected]>

---------

Signed-off-by: Norman Ziegner <[email protected]>

roles/os_hardening/tasks/ctrlaltdel.yml

@@ -4,4 +4,4 @@
     name: ctrl-alt-del.target
     masked: true
     daemon_reload: true
-  when: ansible_service_mgr == "systemd"
+  when: ansible_facts.service_mgr == "systemd"

roles/os_hardening/tasks/limits.yml

@@ -37,7 +37,7 @@
         group: root
         mode: "0755"
         state: directory
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
 
     - name: Create custom.conf for disabling coredumps
       ansible.builtin.template:
@@ -46,7 +46,7 @@
         owner: root
         group: root
         mode: "0644"
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
       notify: Reload systemd
 
 - name: Enable coredumps
@@ -56,7 +56,7 @@
       ansible.builtin.file:
         path: /etc/systemd/coredump.conf.d
         state: absent
-      when: ansible_service_mgr == "systemd"
+      when: ansible_facts.service_mgr == "systemd"
       notify: Reload systemd
 
     - name: Remove 10.hardcore.conf config file

roles/os_hardening/tasks/minimize_access.yml

@@ -89,7 +89,7 @@
 
 - name: Generate list of current available mounted filesystems on the system
   ansible.builtin.set_fact:
-    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"
+    mountpoints_list: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"
 
 - name: Append special devices list to valid mountpoint list
   ansible.builtin.set_fact:

roles/os_hardening/tasks/minimize_access_fs.yml

@@ -13,7 +13,7 @@
     - mount.enabled | bool
     - mount.path in mountpoints_list
   vars:
-    mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
+    mountinfo: "{{ ansible_facts.mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
   notify: Remount filesystems
 
 - name: "Check for existence of mount {{ mount.path }}"

roles/os_hardening/tasks/modprobe.yml

@@ -18,7 +18,7 @@
 
 - name: Remove used filesystems from fs-list
   ansible.builtin.set_fact:
-    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_mounts | map(attribute='fstype') | list) }}"
+    os_unused_filesystems: "{{ os_unused_filesystems | difference(ansible_facts.mounts | map(attribute='fstype') | list) }}"
 
 - name: Disable unused filesystems | os-10
   ansible.builtin.template:

roles/os_hardening/tasks/sysctl.yml

@@ -9,7 +9,7 @@
   when: ansible_facts.os_family == 'RedHat'
 
 - name: Change sysctls
-  when: ansible_virtualization_type not in ['docker', 'lxc', 'openvz']
+  when: ansible_facts.virtualization_type not in ['docker', 'lxc', 'openvz']
   block:
     - name: Protect sysctl.conf
       ansible.builtin.file:

roles/os_hardening/tasks/user_accounts.yml

@@ -4,28 +4,28 @@
     database: passwd
     # creates a dict for each user containing UID/HOMEDIR etc...
   # skip this task if getent was run before without specifying a key (single entry)
-  when: getent_passwd is undefined or
-        getent_passwd | length <= 1
+  when: ansible_facts.getent_passwd is undefined or
+        ansible_facts.getent_passwd | length <= 1
 
 - name: Read local linux shadow database
   ansible.builtin.getent:
     database: shadow
 
 - name: Extract system accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
   when:
-    - getent_passwd[item][1]|int > 0
-    - getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int > 0
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_sys_uid_max|int
     - item is not in os_always_ignore_users     # skip users from "os_always_ignore_users" list (taken from role "vars")
     - item is not in os_ignore_users            # skip users from "os_ignore_users"        list (taken from role "defaults")
   ansible.builtin.set_fact:
     system_users: "{{ system_users | default([]) + [item] }}"
 
 - name: Extract regular (non-system, non-root) accounts from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
   when:
-    - getent_passwd[item][1]|int >= os_auth_uid_min|int
-    - getent_passwd[item][1]|int <= os_auth_uid_max|int
+    - ansible_facts.getent_passwd[item][1]|int >= os_auth_uid_min|int
+    - ansible_facts.getent_passwd[item][1]|int <= os_auth_uid_max|int
     - item is not in os_always_ignore_users # skip users from "os_always_ignore_users" list (taken from role "vars")
     - item is not in os_ignore_users # skip users from "os_ignore_users"        list (taken from role "defaults")
   ansible.builtin.set_fact:
@@ -42,13 +42,14 @@
     - os_user_pw_ageing
     - regular_users is defined and (regular_users | length > 0)
     - item not in os_users_without_password_ageing
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")
 
 - name: Extract root account(s) from local user database
-  loop: "{{ getent_passwd.keys() | list }}"
+  loop: "{{ ansible_facts.getent_passwd.keys() | list }}"
   when:
-    - getent_passwd[item][1]|int == 0
+    - ansible_facts.getent_passwd[item][1]|int == 0
   ansible.builtin.set_fact:
     root_users: "{{ root_users | default([]) + [item] }}"
 
@@ -56,7 +57,7 @@
   ansible.builtin.file:
     mode: "0700"
     owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
     state: directory
   loop: "{{ root_users }}"
   when:
@@ -71,8 +72,9 @@
   loop: "{{ root_users }}"
   when:
     - os_rootuser_pw_ageing | bool
-    - getent_shadow[item][0] is not match("\*") # password hashes containing illegal characters like "*" are unusable (locked) and don't need to age
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable (locked) and don't need to age
+    # password hashes with illegal characters like "*" or "!" are unusable (locked) and don't need to age
+    - ansible_facts.getent_shadow[item][0] is not match("\*")
+    - ansible_facts.getent_shadow[item][0] is not match("\!")
 
 - name: Remove additional users with UID=0 ("root" user is not touched)
   ansible.builtin.user:
@@ -98,13 +100,13 @@
     createhome: false
   loop: "{{ system_users }}"
   when:
-    - getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)
+    - ansible_facts.getent_shadow[item][0] is not match("\!") # password hashes containing illegal characters like "!" are unusable already (locked)
 
 - name: Limit access to home directories of regular (non-system, non-root) accounts
   ansible.builtin.file:
     mode: "0700"
     owner: "{{ item }}"
-    path: "{{ getent_passwd[item][4] }}"
+    path: "{{ ansible_facts.getent_passwd[item][4] }}"
     state: directory
   loop: "{{ regular_users }}"
   when: