From 189c7a6f85d56433cd9000ed2f2c533009c2f051 Mon Sep 17 00:00:00 2001 From: Rich Megginson Date: Tue, 18 Nov 2025 14:12:00 -0700 Subject: [PATCH] fix: support new config file options, expose aide_version Cause: The aide role custom config test is using the old configuration options on newer EL9 systems which use AIDE version 0.17 and later. Consequence: The test gives errors like "ERROR: /etc/aide.conf:12: unexpected character" and the test fails. Fix: The role will now determine the AIDE version, set the new aide_version variable, and use this variable to determine the old or new style configuration. Result: The aide system role can process custom config on all supported AIDE versions. See https://github.com/aide/aide/blob/master/ChangeLog#L241 Signed-off-by: Rich Megginson --- README.md | 25 ++++++++++++++++++++++++- examples/aide-custom.conf.j2 | 25 ++++++++++--------------- tasks/main.yml | 14 ++++++++++++++ tests/files/aide-custom.conf.j2 | 24 +++++++++--------------- 4 files changed, 57 insertions(+), 31 deletions(-) diff --git a/README.md b/README.md index 881d47d..910eb87 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ only. This variable takes a string to specify a path where the custom template for aide.conf is located. -To be sure that everething is correct, template needs to start with following snippet: +To be sure that everything is correct, template needs to start with following snippet: ``` jinja {{ ansible_managed | comment }} @@ -39,6 +39,11 @@ Default: `null` Type: `string` +**NOTE:** The config file format has changed somewhat in AIDE version 0.17. +The role exports a variable `aide_version` which you can use, and see +`examples/aide-custom.conf.j2` for an example of how to conditionally define +configuration which will work across multiple versions of AIDE. + ### aide_db_fetch_dir This variable takes a string to specify the directory on the Ansible Control @@ -113,6 +118,24 @@ Default: `0 12 * * *` Type: `string` +### Variables Exported by the Role + +The role will export the following variables: + +`aide_version` - string - this is the AIDE version you can use if you need to do +something which depends on the version e.g. in your custom template you can do: + +```jinja2 +{% if aide_version is version("0.17.0", ">=") %} +# The location of the database to be read. +database_in=file:@@{DBDIR}/aide.db.gz +... other new style parameters ... +{% else %} +database=file:@@{DBDIR}/aide.db.gz +... other old style parameters ... +{% endif %} +``` + ## Example Playbook Including an example of how to use your role (for instance, with variables diff --git a/examples/aide-custom.conf.j2 b/examples/aide-custom.conf.j2 index e0ce4cf..fd24be1 100644 --- a/examples/aide-custom.conf.j2 +++ b/examples/aide-custom.conf.j2 @@ -5,13 +5,18 @@ @@define DBDIR /var/lib/aide @@define LOGDIR /var/log/aide -{% if ansible_facts['os_family'] == 'RedHat' and - ansible_facts['distribution_major_version'] in ['8','9'] %} -# The location of the database to be read. -database=file:@@{DBDIR}/aide.db.gz -{% else %} +# Get the AIDE version first using command 'aide --version' and then check if it is greater than or equal to 0.17.0 +{% if aide_version is version("0.17.0", ">=") %} # The location of the database to be read. database_in=file:@@{DBDIR}/aide.db.gz +# Default. +log_level=warning +report_level=changed_attributes +{% else %} +# The location of the database to be read. +database=file:@@{DBDIR}/aide.db.gz +# Default. +verbose=5 {% endif %} # The location of the database to be written. @@ -22,16 +27,6 @@ database_out=file:@@{DBDIR}/aide.db.new.gz # Whether to gzip the output to database gzip_dbout=yes -{% if ansible_facts['os_family'] == 'RedHat' and - ansible_facts['distribution_major_version'] in ['8','9'] %} -# Default. -verbose=5 -{% else %} -# Default. -log_level=warning -report_level=changed_attributes -{% endif %} - report_url=file:@@{LOGDIR}/aide.log report_url=stdout #report_url=stderr diff --git a/tasks/main.yml b/tasks/main.yml index c7b586c..7c3882b 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -11,6 +11,20 @@ use: "{{ (__aide_is_ostree | d(false)) | ternary('ansible.posix.rhel_rpm_ostree', omit) }}" +- name: Get AIDE version + ansible.builtin.command: + cmd: aide --version + register: __aide_version_register + changed_when: false + +# assumes the version starts with a digit and goes to the end of the line +- name: Set AIDE version + set_fact: + aide_version: "{{ __output | regex_search('(?m)^A[iI][dD][eE] (\\d.*)$', '\\1') | first }}" + vars: + __output: "{{ __aide_version_register.stdout if __aide_version_register.stdout | length > 0 + else __aide_version_register.stderr }}" + - name: Ensure required services are enabled and started ansible.builtin.service: name: "{{ item }}" diff --git a/tests/files/aide-custom.conf.j2 b/tests/files/aide-custom.conf.j2 index e0ce4cf..c3b9e85 100644 --- a/tests/files/aide-custom.conf.j2 +++ b/tests/files/aide-custom.conf.j2 @@ -5,13 +5,17 @@ @@define DBDIR /var/lib/aide @@define LOGDIR /var/log/aide -{% if ansible_facts['os_family'] == 'RedHat' and - ansible_facts['distribution_major_version'] in ['8','9'] %} -# The location of the database to be read. -database=file:@@{DBDIR}/aide.db.gz -{% else %} +{% if aide_version is version('0.17.0', '>=') %} # The location of the database to be read. database_in=file:@@{DBDIR}/aide.db.gz +# Default. +log_level=warning +report_level=changed_attributes +{% else %} +# The location of the database to be read. +database=file:@@{DBDIR}/aide.db.gz +# Default. +verbose=5 {% endif %} # The location of the database to be written. @@ -22,16 +26,6 @@ database_out=file:@@{DBDIR}/aide.db.new.gz # Whether to gzip the output to database gzip_dbout=yes -{% if ansible_facts['os_family'] == 'RedHat' and - ansible_facts['distribution_major_version'] in ['8','9'] %} -# Default. -verbose=5 -{% else %} -# Default. -log_level=warning -report_level=changed_attributes -{% endif %} - report_url=file:@@{LOGDIR}/aide.log report_url=stdout #report_url=stderr