fix linting

Signed-off-by: Sebastian Gumprich <[email protected]>

.config/ansible-lint.yml

@@ -5,8 +5,9 @@
 # option will be parsed relative to the CWD of execution.
 exclude_paths:
   - .cache/  # implicit unless exclude_paths is defined in config
-#  - .yamllint
-#  - ../molecule/os_hardening/waivers.yaml
+  - .yamllint
+  - ../molecule/
+  - ../.github/
 
 skip_list:
   - fqcn-builtins

.yamllint

@@ -15,19 +15,12 @@ rules:
   commas:
     max-spaces-after: -1
     level: error
-#  comments: disable
-#  comments-indentation: disable
-#  document-start: disable
   empty-lines:
     max: 3
     level: error
   hyphens:
     level: error
-#  indentation: disable
   key-duplicates: enable
   line-length: disable
-#  new-line-at-end-of-file: disable
   new-lines:
     type: unix
-#  trailing-spaces: disable
-#  truthy: disable

galaxy.yml

@@ -1,3 +1,4 @@
+---
 namespace: devsec
 name: hardening
 version: 7.14.3

molecule/nginx_hardening/prepare.yml

@@ -17,7 +17,7 @@
       package:
         name: "python3-apt"
         update_cache: true
-      ignore_errors: true
+      ignore_errors: true  # noqa ignore-errors
 
     - name: Set correct distribution Version for Amazon Linux
       set_fact:

molecule/os_hardening/prepare.yml

@@ -42,7 +42,7 @@
         update_cache: true
       when: ansible_facts.os_family == 'Archlinux'
 
-    - name: install required tools on RHEL
+    - name: install required tools on RHEL  # noqa ignore-errors
       yum:
         name:
           - openssh-clients

molecule/os_hardening/prepare_yum.yml

@@ -0,0 +1,16 @@
+---
+- name: create 'foo' repository
+  ansible.builtin.yum_repository:
+    name: foo
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false
+
+- name: create 'bar' repository
+  ansible.builtin.yum_repository:
+    name: bar
+    description: mandatory description
+    baseurl: file:///mandatory-url
+    enabled: false
+    gpgcheck: false

molecule/os_hardening/verify.yml

@@ -54,7 +54,7 @@
     - name: install cinc-auditor
       shell: "bash /tmp/install.sh -s -- -P cinc-auditor -v 4"
 
-    - name: Execute cinc-auditor tests
+    - name: Execute cinc-auditor tests  # noqa ignore-errors
       command: "/opt/cinc-auditor/bin/cinc-auditor exec --no-show-progress --no-color --no-distinct-exit  --waiver-file waivers.yaml https://github.com/dev-sec/linux-baseline/archive/refs/heads/master.zip"
       register: test_results
       changed_when: false

molecule/ssh_hardening/prepare.yml

@@ -12,7 +12,7 @@
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       yum:
         name:
           - openssh-clients
@@ -22,7 +22,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       dnf:
         name:
           - openssh-clients
@@ -32,7 +32,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       apt:
         name:
           - openssh-client
@@ -66,7 +66,7 @@
         path: "/var/run/sshd"
         state: directory
 
-    - name: create ssh host keys
+    - name: create ssh host keys  # noqa ignore-errors
       command: "ssh-keygen -A"
       when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
             ansible_facts.distribution == "Fedora" or

molecule/ssh_hardening_custom_tests/prepare.yml

@@ -12,7 +12,7 @@
         ansible_python_interpreter: /usr/bin/python3
       when: ansible_facts.distribution == 'Fedora'
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       yum:
         name:
           - openssh-clients
@@ -22,7 +22,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       dnf:
         name:
           - openssh-clients
@@ -32,7 +32,7 @@
         update_cache: true
       ignore_errors: true
 
-    - name: install packages
+    - name: install packages  # noqa ignore-errors
       apt:
         name:
           - openssh-client
@@ -66,7 +66,7 @@
         path: "/var/run/sshd"
         state: directory
 
-    - name: create ssh host keys
+    - name: create ssh host keys  # noqa ignore-errors
       command: "ssh-keygen -A"
       when: not ((ansible_facts.os_family in ['Oracle Linux', 'RedHat']) and ansible_facts.distribution_major_version < '7') or
             ansible_facts.distribution == "Fedora" or

roles/os_hardening/handlers/main.yml

@@ -10,4 +10,4 @@
 
 - name: Reload systemd
   systemd:
-    daemon_reload: yes
+    daemon_reload: true

roles/os_hardening/tasks/ctrlaltdel.yml

@@ -2,6 +2,6 @@
 - name: Disable CTRL-ALT-DEL
   systemd:
     name: ctrl-alt-del.target
-    masked: yes
-    daemon_reload: yes
+    masked: true
+    daemon_reload: true
   when: ansible_service_mgr == "systemd"

roles/ssh_hardening/tasks/selinux.yml

@@ -24,7 +24,8 @@
 # The following tasks only get executed when selinux is in state enforcing,
 # UsePam is 'no' and the ssh_password module is not installed. See this issue for
 # more info: https://github.com/hardening-io/ansible-ssh-hardening/issues/23
-- when:
+- name: run selinux tasks
+  when:
     - not (ssh_use_pam | bool)
     - ('ssh_password' not in ssh_password_module.stdout)
   block:
@@ -44,13 +45,13 @@
         group: 'root'
         mode: '0600'
 
-    - name: Check and compile policy
+    - name: Check and compile policy  # noqa no-changed-when
       command: checkmodule -M -m -o {{ ssh_custom_selinux_dir }}/ssh_password.mod {{ ssh_custom_selinux_dir }}/ssh_password
 
-    - name: Create selinux policy module package
+    - name: Create selinux policy module package  # noqa no-changed-when
       command: semodule_package -o {{ ssh_custom_selinux_dir }}/ssh_password.pp  -m {{ ssh_custom_selinux_dir }}/ssh_password.mod
 
-    - name: Install selinux policy
+    - name: Install selinux policy  # noqa no-changed-when
       command: semodule -i {{ ssh_custom_selinux_dir }}/ssh_password.pp