# selectattr for files' permission

**URL:** <https://forum.ansible.com/t/selectattr-for-files-permission/36686>\
**Category:** Ansible Project\
**Created:** [June 3, 2022, 12:34pm UTC](https://forum.ansible.com/t/selectattr-for-files-permission/36686 "2022-06-03T12:34:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Thuan](https://avatars.discourse-cdn.com/v4/letter/t/ac8455/32.png) [@Thuan](https://forum.ansible.com/u/Thuan)\
**Post date:** [June 3, 2022, 12:34pm UTC](https://forum.ansible.com/t/selectattr-for-files-permission/36686/1 "2022-06-03T12:34:23Z")

</div>

Hello,

My current playbook worked and I just want to know if there room for improvement.

---

<div class="post-metadata">

**Author:** ![Thuan](https://avatars.discourse-cdn.com/v4/letter/t/ac8455/32.png) [@Thuan](https://forum.ansible.com/u/Thuan)\
**Post date:** [June 3, 2022, 1:50pm UTC](https://forum.ansible.com/t/selectattr-for-files-permission/36686/2 "2022-06-03T13:50:53Z")

</div>

revised playbook:

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [June 3, 2022, 4:05pm UTC](https://forum.ansible.com/t/selectattr-for-files-permission/36686/3 "2022-06-03T16:05:24Z")

</div>

This looks like another case of using ansible as a glorified auditing and reporting tool, and shoehorning a round peg into a square hole along the way...

I would ask myself why those permission are changed and prevent that from happening in the first place. If this happens every week/day, are you going to run this playbook then every week/day to 'fix' things?  
Or from cron? That sounds like fixing symptoms rather than problems.

AFAICS the high level logic is

\* finding files  
\* reading their permissions  
\* changing them only if they are not what you want them (in a rescue block?)  
\* creating some sort of log file by (ab)using the lineinfile module

This is more or less re-implementing what ansible already does out of the box - using ansible 🙂

I would take the opposite approach:

\* Ensure those permissions are what you want them to be  
\* Generate a report based on the result

That's it. Should be doable with just two tasks.

---

<div class="post-metadata">

**Author:** ![Thuan](https://avatars.discourse-cdn.com/v4/letter/t/ac8455/32.png) [@Thuan](https://forum.ansible.com/u/Thuan)\
**Post date:** [June 3, 2022, 5:15pm UTC](https://forum.ansible.com/t/selectattr-for-files-permission/36686/4 "2022-06-03T17:15:30Z")

</div>

I’m using the playbook to hardening the O.S, and build new image.  
Block and rescue module give me the report whether that system requires change.