Improve remediation for enable_authselect

linux_os/guide/system/accounts/enable_authselect/ansible/shared.yml

@@ -6,7 +6,14 @@
 
 {{{ ansible_instantiate_variables("var_authselect_profile") }}}
 
-- name: {{{ rule_title }}} - Select authselect profile
+- name: {{{ rule_title }}} - Check Current authselect Profile
+  ansible.builtin.command:
+    cmd: authselect current
+  register: result_authselect_current
+  changed_when: false
+  failed_when: false
+
+- name: {{{ rule_title }}} - Try to Select an authselect Profile
   ansible.builtin.command:
     cmd: authselect select "{{ var_authselect_profile }}"
   register: result_authselect_select
@@ -18,30 +25,36 @@
   # • 4: System configuration must be overwritten to activate an authselect profile, --force parameter is needed.
   # • 5: Executed command must be run as root.
   # • 6: No configuration was detected.
+  changed_when: result_authselect_select.rc == 0
   failed_when: false
+  when:
+    - result_authselect_current.rc != 0
 
-- name: {{{ rule_title }}} - Verify if PAM has been altered
+- name: {{{ rule_title }}} - Verify If pam Has Been Altered
   ansible.builtin.command:
     cmd: rpm -qV pam
   register: result_altered_authselect
   # return:
   # - 0 if no alterations
   # - otherwise: number of failed packages
   #   We have 1 package here. So 1 it is.
+  changed_when: false
   failed_when: false
   when:
+    - result_authselect_select is not skipped
     - result_authselect_select.rc != 0
 
-- name: {{{ rule_title }}} - Informative message based on the authselect integrity check
+- name: {{{ rule_title }}} - Informative Message Based on authselect Integrity Check
   ansible.builtin.assert:
     that:
-      - result_altered_authselect is skipped or result_altered_authselect.rc == 0
+      - result_authselect_current.rc == 0 or result_altered_authselect is skipped or result_altered_authselect.rc == 0
     fail_msg:
-      - Files in the 'pam' package have been altered, so the authselect configuration won't be forced.
+      - authselect is not used but files from the 'pam' package have been altered, so the authselect configuration won't be forced.
 
-- name: {{{ rule_title }}} - Force authselect profile select
+- name: {{{ rule_title }}} - Force authselect Profile Selection
   ansible.builtin.command:
     cmd: authselect select --force "{{ var_authselect_profile }}"
   when:
+    - result_authselect_current.rc != 0
     - result_authselect_select.rc != 0
-    - result_altered_authselect is skipped or result_altered_authselect.rc == 0
+    - result_altered_authselect.rc == 0

linux_os/guide/system/accounts/enable_authselect/bash/shared.sh

@@ -2,12 +2,16 @@
 
 {{{ bash_instantiate_variables("var_authselect_profile") }}}
 
-authselect select "$var_authselect_profile"
+authselect current
 
 if test "$?" -ne 0; then
-    if rpm --quiet --verify pam; then
-        authselect select --force "$var_authselect_profile"
-    else
-	echo "Files in the 'pam' package have been altered, so the authselect configuration won't be forced" >&2
+    authselect select "$var_authselect_profile"
+
+    if test "$?" -ne 0; then
+        if rpm --quiet --verify pam; then
+            authselect select --force "$var_authselect_profile"
+        else
+	        echo "authselect is not used but files from the 'pam' package have been altered, so the authselect configuration won't be forced." >&2
+        fi
     fi
 fi