ansible: how to restart auditd service on centos 7 get error about dependency

Question

In my playbook, i have a task to update audit.rules and then notify a handler which should restart the auditd service.

task:
  - name:  6.6.7 - audit rules configuration
    template: src=X/ansible/templates/auditd_rules.j2
              dest=/etc/audit/rules.d/audit.rules
              backup=yes
              owner=root group=root mode=0640
     notify:
   - restart auditd


  handlers:
    - name: restart auditd
      service: name=auditd state=restarted

When the playbook runs, the audit rules are updated and a request is made to restart auditd but this fails as below.

RUNNING HANDLER [restart auditd] ***********************************************
fatal: [ipX-southeast-2.compute.internal]: FAILED! => {"changed": false, "failed": true, "msg": "Unable to restart service auditd: Failed to restart auditd.service: Operation refused, unit auditd.service may be requested by dependency only.\n"}

When i look at the unit definition for auditd, i can see refuseManualStop=yes. Is this why i cant restart the service? how does one over come this to pickup the new audit rules?

 systemctl cat auditd.service
# /usr/lib/systemd/system/auditd.service
[Unit]
Description=Security Auditing Service
DefaultDependencies=no
After=local-fs.target systemd-tmpfiles-setup.service
Conflicts=shutdown.target
Before=sysinit.target shutdown.target
RefuseManualStop=yes
ConditionKernelCommandLine=!audit=0
Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/

[Service]
ExecStart=/sbin/auditd -n
## To not use augenrules, copy this file to /etc/systemd/system/auditd.service
## and comment/delete the next line and uncomment the auditctl line.
## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/
ExecStartPost=-/sbin/augenrules --load
#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules
ExecReload=/bin/kill -HUP $MAINPID
# By default we don't clear the rules on exit. To enable this, uncomment
# the next line after copying the file to /etc/systemd/system/auditd.service
#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules

[Install]
WantedBy=multi-user.target

Answer 1

This has been explored, discussed, and resolved (mostly) in the Red Hat Bugzilla #1026648 and Anisble Issue # 22171 (github) reports.

Resolution

• Use the ansible service module parameter use=service to force execution of the /sbin/service utility instead of the gathered-fact value of systemd (which invokes /sbin/systemctl) like this:
  • - service: name=auditd state=restarted use=service
• Example playbook (pastebin.com)

Workaround:

• Use the ansible command module to explicitly run the service executable like this:
  • - command: /sbin/service auditd restart

Analysis - root cause:

• This is an issue created by upstream packaging of auditd.service unit. It will not start/stop/restart when acted upon by systemctl, apparently by design.
• It is further compounded by the Ansible service control function, which uses the preferred method identified when system facts are gathered and "ansible_service_mgr" returns "systemd". This is regardless of the actual module used to manage the service.unit.
• RHEL dev team may fix if considered a problem in upcoming updates (ERRATA)
• Ansible dev team has offered a workaround and (as of 2.2) updated the service module with the use parameter.

Answer 2

Maybe is quit late for the answer, but if anyone else is facing the same problem, you can import the new rules for auditd with this command :

auditctl -R /path/to_your_rules_file

So, no need to restart auditd.service to import new rules