[Stabilization]: add when conditional to Ansible remediation of sssd_enable_pam_services

[vojtapolasek]

Description:

• add a when conditional so that the task replacing values in files within /etc/sssd/conf.d directory is not executed in case no files are found

Rationale:

• older Ansible versions might terminate prematurely if there are no config files found in /etc/sssd/conf.d directory

Review Hints:

1. provision RHEL 7 machine with official Ansible version 2.9.27
2. ./build_product rhel7
3. upload the stig ansible playbook to the machine
4. now in the machine, run

ansible-playbook -u root -i localhost, -c local --tags sssd_enable_pam_services playbook.yml

If you build the content before this PR, it should crash. It should finish without errors when this PR is added.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_sssd_enable_pam_services' differs.
--- xccdf_org.ssgproject.content_rule_sssd_enable_pam_services
+++ xccdf_org.ssgproject.content_rule_sssd_enable_pam_services
@@ -39,7 +39,9 @@
     replace: \1,pam
   with_items: '{{ sssd_conf_d_files.files | map(attribute=''path'') }}'
   register: modify_lines_sssd_conf_d_files
-  when: '"sssd-common" in ansible_facts.packages'
+  when:
+  - '"sssd-common" in ansible_facts.packages'
+  - sssd_conf_d_files.matched is defined and sssd_conf_d_files.matched >= 1
   tags:
   - CCE-82446-6
   - NIST-800-53-CM-6(a)

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11979
This image was built from commit: 6f93bc0

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11979

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11979 make deploy-local

[jan-cerny]

I have confirmed on RHEL 7.9 that this patch fixes the problem.

The fail of Automatus on SLE15 is expected because this rule isn't part of the SLE15 content.

[jan-cerny]

@vojtapolasek please send a link to the master variant of this patch

[vojtapolasek]

The PR against master is here: #11982