do not persist sysctl when value is invalid

[schurzi]

SUMMARY

the order of actions for setting, persisting and activation is changed,
to not persist an invalid sysctl value. This is only enforced when
sysct_set is True.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

sysctl

ADDITIONAL INFORMATION

we had some "fun" with the original behaviour in this PR: dev-sec/ansible-collection-hardening#312

Once a invalid value is persisted every change of a sysctl (with a reload) triggers an error. This complecates debugging and makes the real error non obvious for the user.

Playbook:

- hosts: localhost
  tasks:
    - name: Set sysctl property using module
      sysctl:
        name: vm.mmap_rnd_bits
        value: '1024'
        state: present
        reload: yes
        sysctl_set: True

Before:

# ansible-playbook -vvv test.yml
...
fatal: [localhost]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "ignoreerrors": false,
            "name": "vm.mmap_rnd_bits",
            "reload": true,
            "state": "present",
            "sysctl_file": "/etc/sysctl.conf",
            "sysctl_set": true,
            "value": "1024"
        }
    },
    "msg": "Failed to reload sysctl: vm.mmap_rnd_bits = 1024\nsysctl: setting key \"vm.mmap_rnd_bits\": Invalid argument\n"
# grep mmap /etc/sysctl.conf
vm.mmap_rnd_bits=1024

After

# ansible-playbook -vvv test.yml
...
fatal: [localhost]: FAILED! => {
    "changed": false,
    "invocation": {
        "module_args": {
            "ignoreerrors": false,
            "name": "vm.mmap_rnd_bits",
            "reload": true,
            "state": "present",
            "sysctl_file": "/etc/sysctl.conf",
            "sysctl_set": true,
            "value": "1024"
        }
    },
    "msg": "setting vm.mmap_rnd_bits failed: vm.mmap_rnd_bits = 1024\nsysctl: setting key \"vm.mmap_rnd_bits\": Invalid argument\n"
# grep mmap /etc/sysctl.conf

[maxamillion]

/recheck

[schurzi]

is there something I need to do or fix to get the tests green?

[maxamillion]

@schurzi I don't think so, the galaxy import bit is what's failing in CI

[maxamillion]

/recheck

[maxamillion]

recheck