The ansible-meltdown-spectre-inventory from dmsimard

ansible-meltdown-spectre-inventory's People

Stargazers

ansible-meltdown-spectre-inventory's Issues

Sudo required on CentOS 7

First of all, thank you so much for this tool.

Testing on a single host, I needed to become: yes on the pti_command in order to get this to work:

TASK [Check if Kernel PTI is enabled] ******************************************
task path: /Users/alan/Sites/dmsimard_ansible-meltdown-spectre-inventory/get-inventory.yml:26
ok: [35.157.187.58] => {"changed": false, "cmd": "grep 1 /sys/kernel/debug/x86/pti_enabled", "delta": "0:00:00.004562", "end": "2018-01-12 15:50:43.759072", "failed_when_result": false, "msg": "non-zero return code", "rc": 2, "start": "2018-01-12 15:50:43.754510", "stderr": "grep: /sys/kernel/debug/x86/pti_enabled: Permission denied", "stderr_lines": ["grep: /sys/kernel/debug/x86/pti_enabled: Permission denied"], "stdout": "", "stdout_lines": []}

At first I added --become to my ansible-playbook command, but I got:

TASK [Create inventory file for meltdown] **************************************
task path: /Users/alan/Sites/dmsimard_ansible-meltdown-spectre-inventory/get-inventory.yml:10
fatal: [35.157.187.58]: FAILED! => {"msg": "Failed to get information on remote file (/tmp/meltdown-inventory): sudo: a password is required\n"}

So, with this change, it's working for checking all of our instances, though I happen to know that my --user has sudo privileges (which may not be universal for a tool intended for wide release):

     - name: Check if Kernel PTI is enabled
       shell: |
         {{ pti_command }}
       changed_when: false
       failed_when: false
       register: pti_enabled
       when: "'GenuineIntel' in ansible_processor"
+      become: true

Recommend Projects