Skip to content

Conversation

@FrsECM
Copy link

@FrsECM FrsECM commented Nov 14, 2025

Please ensure that you have understood contributing guide
Ensure all commits are signed-by and gpg signed

Issue Fixes:
I got an issue with prelim because of the changed_when condition that is a dict and should be a string to be compared to "absent".

TASK [ubuntu22-cis : PRELIM | PATCH | Ensure conf.d directory exists required for 5.3.3.2.x] ********************************************************************
[ERROR]: Task failed: Action failed: Unknown error.
Origin: /Users/fponchon/code/infrastructure/michelin-ansible/roles/ubuntu22-cis/tasks/prelim.yml:153:3

151   register: prelim_pam_conf_files
152
153 - name: PRELIM | PATCH | Ensure conf.d directory exists required for 5.3.3.2.x
      ^ column 3

failed: [localhost] (item={'path': '/etc/security/pwquality.conf.d', 'state': 'directory'}) => {"ansible_loop_var": "item", "changed": false, "changed_when_result": "Error while evaluating conditional: object of type 'dict' has no attribute 'diff'", "gid": 0, "group": "root", "item": {"path": "/etc/security/pwquality.conf.d", "state": "directory"}, "mode": "0750", "msg": "Task failed: Action failed: Unknown error.", "owner": "root", "path": "/etc/security/pwquality.conf.d", "size": 4096, "state": "directory", "uid": 0}
failed: [localhost] (item={'path': '/etc/security/pwquality.conf.d/cis_dummy.conf', 'state': 'touch'}) => {"ansible_loop_var": "item", "changed": false, "changed_when_result": "Error while evaluating conditional: object of type 'dict' has no attribute 'diff'", "dest": "/etc/security/pwquality.conf.d/cis_dummy.conf", "gid": 0, "group": "root", "item": {"path": "/etc/security/pwquality.conf.d/cis_dummy.conf", "state": "touch"}, "mode": "0640", "msg": "Task failed: Action failed: Unknown error.", "owner": "root", "size": 0, "state": "file", "uid": 0}

In order to fix, i propose to use "changed" attributes of the result in the same task.

TASK [ubuntu22-cis : PRELIM | PATCH | Ensure conf.d directory exists required for 5.3.3.2.x] ********************************************************************
ok: [localhost] => (item={'path': '/etc/security/pwquality.conf.d', 'state': 'directory'}) => {"ansible_loop_var": "item", "changed": false, "gid": 0, "group": "root", "item": {"path": "/etc/security/pwquality.conf.d", "state": "directory"}, "mode": "0750", "owner": "root", "path": "/etc/security/pwquality.conf.d", "size": 4096, "state": "directory", "uid": 0}

How has this been tested?:
It have been test on a VM on with a fresh Ubuntu 22.04.

@github-actions
Copy link

Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
Please join in the conversation happening on the Discord Server as well.

Signed-off-by: François Ponchon <[email protected]>
@FrsECM FrsECM force-pushed the fix/prelim-conf.d-changed-issue branch from d409a89 to 82ffd5e Compare November 15, 2025 09:30
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

testing on 2.16 and 2.19 i believe we could remove the register and changed_when looks like it is a legacy addition.

@uk-bolly
Copy link
Member

hi @FrsECM

Thank you for taking the time to raise this PR and the issue you are seeing. I have added a comment that works when i have tested on two versions.
If i could also ask if you could GPG sign your commits we're happy to accept and merge.

Many thanks

uk-bolly

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants