Answers: <p>Q: <strong>&quot;<em>Check if all items are own by root.</em>&quot;</strong></p>
  <p>A: Put the list of the tools into the variable <em>audit_tools</em>. Compare the length of the lists. For example</p>
  <pre class="lang-yaml prettyprint-override"><code>- hosts: localhost
    vars:
      audit_tools:
        - auditctl
        - aureport
        - ausearch
        - autrace
        - auditd
        - audispd
        - augenrules
    tasks:
      - block:
          - stat:
              path: &quot;/sbin/{{ item }}&quot;
            loop: &quot;{{ audit_tools }}&quot;
            register: result
          - assert:
              that: no_audit_tools == no_owner_root
              fail_msg: &quot;One or more tools are not own by root.&quot;
            vars:
              no_audit_tools: &quot;{{ audit_tools|length }}&quot;
              no_owner_root: &quot;{{ result.results|
                                 json_query('[?stat.pw_name==`root`]')|
                                 length }}&quot;
        rescue:
          - debug:
              msg: &quot;Rescue: audit tools not owned by root.&quot;
  </code></pre>
  <p>If not all items are owned by root <em>assert</em> will fail and the <em>block</em> will proceed to the <em>rescue</em> section</p>
  <pre class="lang-yaml prettyprint-override"><code>TASK [assert] ****
  fatal: [localhost]: FAILED! =&gt; changed=false 
    assertion: no_audit_tools == no_owner_root
    evaluated_to: false
    msg: One or more tools are not own by root.
  
  TASK [debug] ****
  ok: [localhost] =&gt; 
    msg: 'Rescue: audit tools not owned by root.'
  </code></pre>
  <hr>
  <p>Q: <strong>&quot;<em>This solution requires <a href="https://jmespath.org/" rel="noreferrer">JMESPath</a> to be installed. Is there an alternative solution?</em>&quot;</strong></p>
  <p>A: Yes. It is. Use Jinja filter <a href="https://jinja.palletsprojects.com/en/master/templates/#selectattr" rel="noreferrer">selectattr</a></p>
  <pre class="lang-yaml prettyprint-override"><code>            no_owner_root: &quot;{{ result.results|
                                 selectattr('stat.pw_name', 'eq', 'root')|
                                 list|length }}&quot;
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2020-12-20T17:10:24.200Z
Answers: Hi,  with your example, where do you put the audit tools list ? Can you explain the length of 'vars' ?
Answers: sudoi
Answers: CC BY-SA 4.0
Answers: 2020-12-20T17:20:09.523Z
Answers: Thanks for the update. I'm not sure I understand about the length string. Would this work? `code` "{{ result.results.map (attribute '?stat.pw_name==`root`] ) |
                                 length }}" `code`
Answers: sudoi
Answers: CC BY-SA 4.0
Answers: 2020-12-20T17:20:34.273Z
Answers: See the complete playbook. Take a look at [length](https://jinja.palletsprojects.com/en/master/templates/#length) and [json_query](https://docs.ansible.com/ansible/devel/user_guide/playbooks_filters.html#selecting-json-data-json-queries).
Answers: Vladimir Botka
Answers: CC BY-SA 4.0
Answers: 2020-12-21T02:14:56.110Z
Answers: This solution requires a 'jmespath' to be installed on the OS. Is there an alternative solution to this ?
Answers: sudoi
Answers: CC BY-SA 4.0
Answers: 2020-12-21T07:12:56.477Z
Answers: I've updated the answer. Open new questions if you have other issues.
Answers: Vladimir Botka
Answers: CC BY-SA 4.0
Answers: 2020-12-20T16:33:15.100Z
Answers: 2020-12-21T07:09:04.480Z
Answers: 2020-12-21T07:09:04.480Z
Answers: Vladimir Botka
Body: <p>What’s the best way to use registered variable ‘audit_tools’ to check if all items are own by root ?
  Do I need to use Jinja2 filter or something ?</p>
  <p>Thanks</p>
  <pre><code>- name: Verify audit tools are own by root user.
    block: 
      - name: check if audit tools are own by root user.
        become: true
        stat:
          path: &quot;/sbin/{{ audit_loop }}&quot;
        loop:
          - auditctl
          - aureport
          - ausearch
          - autrace
          - auditd
          - audispd
          - augenrules
        loop_control:
          loop_var: audit_loop
        register: audit_tools
  
      debug:
        msg: “one or more tools are not own by root.”
      When: .....
  
  
  
    Rescue
       ......
  </code></pre>
  
Tags: <ansible><linux><cicd>
Title: Ansible: register variable with loop
UserDisplayName: sudoi
ThreadText: # Ansible: register variable with loop
  
  (Asked by: username_0 on 2020-12-20)
  
  What’s the best way to use registered variable ‘audit\_tools’ to check if all items are own by root ?
  Do I need to use Jinja2 filter or something ?
  
  Thanks
  
  ```
  - name: Verify audit tools are own by root user.
    block: 
      - name: check if audit tools are own by root user.
        become: true
        stat:
          path: "/sbin/{{ audit_loop }}"
        loop:
          - auditctl
          - aureport
          - ausearch
          - autrace
          - auditd
          - audispd
          - augenrules
        loop_control:
          loop_var: audit_loop
        register: audit_tools
  
      debug:
        msg: “one or more tools are not own by root.”
      When: .....
  
    Rescue
       ......
  
  ```
  
  **Tags:** ansible, linux, cicd
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2020-12-20. Score: 6
  
  Q: **"*Check if all items are own by root.*"**
  
  A: Put the list of the tools into the variable *audit\_tools*. Compare the length of the lists. For example
  
  ```yaml
  - hosts: localhost
    vars:
      audit_tools:
        - auditctl
        - aureport
        - ausearch
        - autrace
        - auditd
        - audispd
        - augenrules
    tasks:
      - block:
          - stat:
              path: "/sbin/{{ item }}"
            loop: "{{ audit_tools }}"
            register: result
          - assert:
              that: no_audit_tools == no_owner_root
              fail_msg: "One or more tools are not own by root."
            vars:
              no_audit_tools: "{{ audit_tools|length }}"
              no_owner_root: "{{ result.results|
                                 json_query('[?stat.pw_name==`root`]')|
                                 length }}"
        rescue:
          - debug:
              msg: "Rescue: audit tools not owned by root."
  
  ```
  
  If not all items are owned by root *assert* will fail and the *block* will proceed to the *rescue* section
  
  ```yaml
  TASK [assert] ****
  fatal: [localhost]: FAILED! => changed=false 
    assertion: no_audit_tools == no_owner_root
    evaluated_to: false
    msg: One or more tools are not own by root.
  
  TASK [debug] ****
  ok: [localhost] => 
    msg: 'Rescue: audit tools not owned by root.'
  
  ```
  
  ---
  
  Q: **"*This solution requires [JMESPath](https://jmespath.org/) to be installed. Is there an alternative solution?*"**
  
  A: Yes. It is. Use Jinja filter [selectattr](https://jinja.palletsprojects.com/en/master/templates/#selectattr)
  
  ```yaml
              no_owner_root: "{{ result.results|
                                 selectattr('stat.pw_name', 'eq', 'root')|
                                 list|length }}"
  
  ```
  
  > **Comments:**
  > **username_0**: Hi,  with your example, where do you put the audit tools list ? Can you explain the length of 'vars' ?  
  > **username_0**: Thanks for the update. I'm not sure I understand about the length string. Would this work? `code` "{{ result.results.map (attribute '?stat.pw_name==`root`] ) |                                length }}" `code`  
  > **username_1**: See the complete playbook. Take a look at [length](https://jinja.palletsprojects.com/en/master/templates/#length) and [json_query](https://docs.ansible.com/ansible/devel/user_guide/playbooks_filters.html#selecting-json-data-json-queries).  
  > **username_0**: This solution requires a 'jmespath' to be installed on the OS. Is there an alternative solution to this ?  
  > **username_1**: I've updated the answer. Open new questions if you have other issues.  
  
  ---
  
  