Execute check of MySQL error logfile permissions on Debian 11 only when log_error is defined

[123quhiwiwk]

This PR fixes checking of log_error file permissions from MariaDB on Debian 11.

If no log_file is defined, then logs goes to systemd and not to the log file. So skip checking permissions of the log_error file if no log_error file is defined on Debian 11.

Fixes #476

[rndmh3ro]

That's the approach I'd have taken, too.
However Debian 11 is not the only OS that uses systemd/journald. So I'd like to have that condition to work on all OS:

- name: Ensure permissions on mysql-logfile are correct
  file:
    path: '{{ mysql_hardening_log_file }}'
    state: file
    owner: '{{ mysql_hardening_user }}'
    group: '{{ mysql_hardening_group }}'
    mode: '0640'
  when: mysql_settings.settings.log_error == ""

[rndmh3ro]

LGTM! Can you please sign-off your commits (see https://github.com/dev-sec/ansible-collection-hardening/pull/477/checks?check_run_id=3399247983)?

---

I just had an even better idea (I think).
Now that we have a variable that defines the path to the log-file, we can take this variable and use it here:

- name: Ensure permissions on mysql-logfile are correct
  file:
    path: '{{ mysql_settings.settings.log_error }}'
    state: file
    owner: '{{ mysql_hardening_user }}'
    group: '{{ mysql_hardening_group }}'
    mode: '0640'
  when: mysql_settings.settings.log_error != ""

I guess this could work.

Then the variable-definition mysql_hardening_log_file can be removed, too. There may be even more things we could dynamically check.
But let's do this in another PR.

[123quhiwiwk]

Yes, mysql_settings.settings.log_error in path seems to work.

What also comes to my mind just now:
I want to activate logging to this error file using the mysql_hardening_options.
So in this case this file will not be checked for permissions.
Would it be possible to check the log_error file after applying the hardening configuration (and restart of db), so that the permissions of this file will also be checked?

[rndmh3ro]

Would it be possible to check the log_error file after applying the hardening configuration (and restart of db), so that the permissions of this file will also be checked?

In my opinion the configuration of log_error should be done with another role (that installs mysql).
The mysql-hardening role is (somewhat) idempotent so re-running it after changing the log_error-var is possible.

[rndmh3ro]

Thank you, @123quhiwiwk!