To remediate the remaining issues, we should generate and execute the bash script:
$ ansible-galaxy init roles/fix-bash
As this is a nice-to-have, I am not going to go into any detail about the ins and outs of what we are adding here. The contents of roles/fix-bash/defaults/main.yml are similar to those in the fix-ansible role:
bash_file: remote: "/tmp/{{ inventory_hostname }}_bash.sh" log: "generated/{{ inventory_hostname }}_bash.log"bash_fix_command: > oscap xccdf generate fix --profile {{ oscap.profile }} --output {{ bash_file.remote }} {{ report.results }}
The tasks in roles/fix-bash/tasks/main.yml are also similar and shouldn't need any explanation:
- name: do we already have the bash script? stat: ...
