<p>Q: <strong>&quot;<em>Check if all items are own by root.</em>&quot;</strong></p>
<p>A: Put the list of the tools into the variable <em>audit_tools</em>. Compare the length of the lists. For example</p>
<pre class="lang-yaml prettyprint-override"><code>- hosts: localhost
  vars:
    audit_tools:
      - auditctl
      - aureport
      - ausearch
      - autrace
      - auditd
      - audispd
      - augenrules
  tasks:
    - block:
        - stat:
            path: &quot;/sbin/{{ item }}&quot;
          loop: &quot;{{ audit_tools }}&quot;
          register: result
        - assert:
            that: no_audit_tools == no_owner_root
            fail_msg: &quot;One or more tools are not own by root.&quot;
          vars:
            no_audit_tools: &quot;{{ audit_tools|length }}&quot;
            no_owner_root: &quot;{{ result.results|
                               json_query('[?stat.pw_name==`root`]')|
                               length }}&quot;
      rescue:
        - debug:
            msg: &quot;Rescue: audit tools not owned by root.&quot;
</code></pre>
<p>If not all items are owned by root <em>assert</em> will fail and the <em>block</em> will proceed to the <em>rescue</em> section</p>
<pre class="lang-yaml prettyprint-override"><code>TASK [assert] ****
fatal: [localhost]: FAILED! =&gt; changed=false 
  assertion: no_audit_tools == no_owner_root
  evaluated_to: false
  msg: One or more tools are not own by root.

TASK [debug] ****
ok: [localhost] =&gt; 
  msg: 'Rescue: audit tools not owned by root.'
</code></pre>
<hr>
<p>Q: <strong>&quot;<em>This solution requires <a href="https://jmespath.org/" rel="noreferrer">JMESPath</a> to be installed. Is there an alternative solution?</em>&quot;</strong></p>
<p>A: Yes. It is. Use Jinja filter <a href="https://jinja.palletsprojects.com/en/master/templates/#selectattr" rel="noreferrer">selectattr</a></p>
<pre class="lang-yaml prettyprint-override"><code>            no_owner_root: &quot;{{ result.results|
                               selectattr('stat.pw_name', 'eq', 'root')|
                               list|length }}&quot;
</code></pre>

CC BY-SA 4.0
2020-12-20T17:10:24.200Z
Hi,  with your example, where do you put the audit tools list ? Can you explain the length of 'vars' ?
sudoi
CC BY-SA 4.0
2020-12-20T17:20:09.523Z
Thanks for the update. I'm not sure I understand about the length string. Would this work? `code` "{{ result.results.map (attribute '?stat.pw_name==`root`] ) |
                               length }}" `code`
sudoi
CC BY-SA 4.0
2020-12-20T17:20:34.273Z
See the complete playbook. Take a look at [length](https://jinja.palletsprojects.com/en/master/templates/#length) and [json_query](https://docs.ansible.com/ansible/devel/user_guide/playbooks_filters.html#selecting-json-data-json-queries).
Vladimir Botka
CC BY-SA 4.0
2020-12-21T02:14:56.110Z
This solution requires a 'jmespath' to be installed on the OS. Is there an alternative solution to this ?
sudoi
CC BY-SA 4.0
2020-12-21T07:12:56.477Z
I've updated the answer. Open new questions if you have other issues.
Vladimir Botka
CC BY-SA 4.0
2020-12-20T16:33:15.100Z
2020-12-21T07:09:04.480Z
2020-12-21T07:09:04.480Z
Vladimir Botka
<p>What’s the best way to use registered variable ‘audit_tools’ to check if all items are own by root ?
Do I need to use Jinja2 filter or something ?</p>
<p>Thanks</p>
<pre><code>- name: Verify audit tools are own by root user.
  block: 
    - name: check if audit tools are own by root user.
      become: true
      stat:
        path: &quot;/sbin/{{ audit_loop }}&quot;
      loop:
        - auditctl
        - aureport
        - ausearch
        - autrace
        - auditd
        - audispd
        - augenrules
      loop_control:
        loop_var: audit_loop
      register: audit_tools

    debug:
      msg: “one or more tools are not own by root.”
    When: .....



  Rescue
     ......
</code></pre>

<ansible><linux><cicd>
Ansible: register variable with loop
sudoi
# Ansible: register variable with loop

(Asked by: username_0 on 2020-12-20)

What’s the best way to use registered variable ‘audit_tools’ to check if all items are own by root ?
Do I need to use Jinja2 filter or something ?
Thanks
- name: Verify audit tools are own by root user.
  block: 
    - name: check if audit tools are own by root user.
      become: true
      stat:
        path: "/sbin/{{ audit_loop }}"
      loop:
        - auditctl
        - aureport
        - ausearch
        - autrace
        - auditd
        - audispd
        - augenrules
      loop_control:
        loop_var: audit_loop
      register: audit_tools

    debug:
      msg: “one or more tools are not own by root.”
    When: .....



  Rescue
     ......

**Tags:** ansible, linux, cicd


---

## 1 answers

### Answer by username_1 on 2020-12-20. Score: 6

Q: "Check if all items are own by root."
A: Put the list of the tools into the variable audit_tools. Compare the length of the lists. For example
- hosts: localhost
  vars:
    audit_tools:
      - auditctl
      - aureport
      - ausearch
      - autrace
      - auditd
      - audispd
      - augenrules
  tasks:
    - block:
        - stat:
            path: "/sbin/{{ item }}"
          loop: "{{ audit_tools }}"
          register: result
        - assert:
            that: no_audit_tools == no_owner_root
            fail_msg: "One or more tools are not own by root."
          vars:
            no_audit_tools: "{{ audit_tools|length }}"
            no_owner_root: "{{ result.results|
                               json_query('[?stat.pw_name==`root`]')|
                               length }}"
      rescue:
        - debug:
            msg: "Rescue: audit tools not owned by root."

If not all items are owned by root assert will fail and the block will proceed to the rescue section
TASK [assert] ****
fatal: [localhost]: FAILED! => changed=false 
  assertion: no_audit_tools == no_owner_root
  evaluated_to: false
  msg: One or more tools are not own by root.

TASK [debug] ****
ok: [localhost] => 
  msg: 'Rescue: audit tools not owned by root.'


Q: "This solution requires JMESPath to be installed. Is there an alternative solution?"
A: Yes. It is. Use Jinja filter selectattr
            no_owner_root: "{{ result.results|
                               selectattr('stat.pw_name', 'eq', 'root')|
                               list|length }}"

> **Comments:**
> **username_0**: Hi,  with your example, where do you put the audit tools list ? Can you explain the length of 'vars' ?  
> **username_0**: Thanks for the update. I'm not sure I understand about the length string. Would this work? `code` "{{ result.results.map (attribute '?stat.pw_name==`root`] ) |                                length }}" `code`  
> **username_1**: See the complete playbook. Take a look at [length](https://jinja.palletsprojects.com/en/master/templates/#length) and [json_query](https://docs.ansible.com/ansible/devel/user_guide/playbooks_filters.html#selecting-json-data-json-queries).  
> **username_0**: This solution requires a 'jmespath' to be installed on the OS. Is there an alternative solution to this ?  
> **username_1**: I've updated the answer. Open new questions if you have other issues.  

---

