Repository: ansible/ansible

Issue:
Add support for yum options related to security
#### ISSUE TYPE
Feature Idea

#### COMPONENT NAME
yum module

#### SUMMARY
yum these days comes with the ability to perform the following security related actions:

```
yum update --security # updates only the packages that need security related updates
yum update --cve CVE-2015-4000 # updates all packages with fixes for the given CVE
yum update --advisory=ALAS-2015-551 # updates packages in the scope of the given security advisory
```

As a person who administers fleets of servers, I often want to perform fixes that are security driven, and the above operations come in handy.

Ansible, however, has no support for these as of now.

Here's a page explaining these features: https://access.redhat.com/solutions/10021



Discussion:
+1

Hi there,

I find myself in the same situation like @sankalp-khare here. I would appreciate it, when the requested features could be added to the yum module. In addition to I would like to be able to run the following command as well, like it is described in KB [How to install a specific security advisory using yum?](https://access.redhat.com/solutions/1552153)

`]# yum update-minimal --advisory RHSA-2015:1210`

Resolving patch:
diff --git a/lib/ansible/modules/packaging/os/yum.py b/lib/ansible/modules/packaging/os/yum.py
--- a/lib/ansible/modules/packaging/os/yum.py
+++ b/lib/ansible/modules/packaging/os/yum.py
@@ -136,6 +136,13 @@
     default: "/"
     aliases: []
 
+  security:
+    description:
+      - If set to C(yes), then installs all security updates.
+    default: "no"
+    choices: ["yes", "no"]
+    version_added: "2.4"
+
 notes:
   - When used with a loop of package names in a playbook, ansible optimizes
     the call to the yum module.  Instead of calling the module with a single
@@ -165,6 +172,7 @@
     - "Seth Vidal"
     - "Eduard Snesarev (github.com/verm666)"
     - "Berend De Schouwer (github.com/berenddeschouwer)"
+    - "Abhijeet Kasurde (github.com/akasurde)"
 '''
 
 EXAMPLES = '''
@@ -1058,7 +1066,7 @@ def latest(module, items, repoq, yum_basecmd, conf_file, en_repos, dis_repos, in
     return res
 
 def ensure(module, state, pkgs, conf_file, enablerepo, disablerepo,
-           disable_gpg_check, exclude, repoq, skip_broken, installroot='/'):
+           disable_gpg_check, exclude, repoq, skip_broken, security, installroot='/'):
 
     # fedora will redirect yum to dnf, which has incompatibilities
     # with how this module expects yum to operate. If yum-deprecated
@@ -1160,6 +1168,8 @@ def ensure(module, state, pkgs, conf_file, enablerepo, disablerepo,
     elif state == 'latest':
         if disable_gpg_check:
             yum_basecmd.append('--nogpgcheck')
+        if security:
+            yum_basecmd.append('--security')
         res = latest(module, pkgs, repoq, yum_basecmd, conf_file, en_repos, dis_repos, installroot=installroot)
     else:
         # should be caught by AnsibleModule argument_spec
@@ -1200,6 +1210,7 @@ def main():
             installroot=dict(required=False, default="/", type='str'),
             # this should not be needed, but exists as a failsafe
             install_repoquery=dict(required=False, default="yes", type='bool'),
+            security=dict(default="no", type='bool'),
         ),
         required_one_of=[['name', 'list']],
         mutually_exclusive=[['name', 'list']],
@@ -1254,9 +1265,10 @@ def main():
         disablerepo = params.get('disablerepo', '')
         disable_gpg_check = params['disable_gpg_check']
         skip_broken = params['skip_broken']
+        security = params['security']
         results = ensure(module, state, pkg, params['conf_file'], enablerepo,
                          disablerepo, disable_gpg_check, exclude, repoquery,
-                         skip_broken, params['installroot'])
+                         skip_broken, security, params['installroot'])
         if repoquery:
             results['msg'] = '%s %s' % (results.get('msg', ''),
                     'Warning: Due to potential bad behaviour with rhnplugin and certificates, used slower repoquery calls instead of Yum API.')


Test patch: