RHEL-08-020027 failed

[PrymalInstynct]

Describe the Issue
RHEL-08-020027 failed with no changed to defaults/main.yml

FAILED! => {"changed": true, "cmd": "semanage fcontext -m -t faillog_t -s system_u /var/log/faillock", "delta": "0:00:02.776896", "end": "2022-02-23 09:42:41.815114", "msg": "non-zero return code", "rc": 1, "start": "2022-02-23 09:42:39.038218", "stderr": "ValueError: File context for /var/log/faillock is not defined", "stderr_lines": ["ValueError: File context for /var/log/faillock is not defined"], "stdout": "", "stdout_lines": []}

Expected Behavior
I expect the task to pass without errors

Actual Behavior
tasks fail

Control(s) Affected
RHEL-08-020027

Environment (please complete the following information):

• Ansible Version: 2.12.2
• Host Python Version: Python 3.6.8
• Ansible Server Python Version: Python 3.8.10
• Additional Details:

Additional Notes
Anything additional goes here

Possible Solution
The tasks for this STIG seem a bit complicated I have tested the following and it worked
The directory gets created with the correct context and then the fcontext gets added so the change is permanent when running restorecon

      - name: Part 1
        file:
            path: "{{ rhel8stig_pam_faillock.dir }}"
            owner: root
            group: root
            mode: '0700'
            state: directory
            recurse: yes
            setype: faillog_t

      - name: Part 2
        sefcontext:
            target: "{{ rhel8stig_pam_faillock.dir }}"
            ftype: d
            setype: faillog_t
            state: present

[bbaassssiiee]

I noticed this happened on a RHEL8.5 kickstarted with the STIG hardening and applying this role from devel.
Workaround still works https://issuehint.com/issue/ansible-lockdown/RHEL8-STIG/87

[Rwarcards762]

FWIW, on RHEL 8.6 but using Ansible 2.9, this fails unless recurse: true is changed to recurse: yes. Not sure if this is intended behavior or not.

[bbaassssiiee]

Using yes for Boolean values is a regression.
Yaml 1.2 mandates true/false