From 9a9389c95df0b0b394bc902be3744e5ce5aada10 Mon Sep 17 00:00:00 2001
From: Erdmann Nils <nils.erdmann@nokia.com>
Date: Tue, 25 Aug 2026 14:25:15 +0000
Subject: [PATCH] Combined authselect command to set custom-profile and
 features as an atomic task

---
 shared/macros/10-ansible.jinja | 15 ++-------------
 shared/macros/10-bash.jinja    |  5 +----
 2 files changed, 3 insertions(+), 17 deletions(-)

diff --git a/shared/macros/10-ansible.jinja b/shared/macros/10-ansible.jinja
index 63b0bdec904..38a24b9fc8d 100644
--- a/shared/macros/10-ansible.jinja
+++ b/shared/macros/10-ansible.jinja
@@ -2156,9 +2156,9 @@ Part of the grub2_bootloader_argument_absent template.
     - authselect_current_profile is not match("custom/")
     - authselect_custom_profile is not match(authselect_current_profile)
 
-- name: '{{{ rule_title }}} - Ensure the authselect custom profile is selected'
+- name: '{{{ rule_title }}} - Ensure the authselect custom profile and features are selected'
   ansible.builtin.command:
-    cmd: authselect select {{ authselect_custom_profile }}
+    cmd: authselect select {{ authselect_custom_profile }} {{ result_authselect_features.stdout_lines | join(' ') }}
   register: result_pam_authselect_select_profile
   when:
     - result_authselect_check_cmd is success
@@ -2166,21 +2166,10 @@ Part of the grub2_bootloader_argument_absent template.
     - authselect_current_profile is not match("custom/")
     - authselect_custom_profile is not match(authselect_current_profile)
 
-- name: '{{{ rule_title }}} - Restore the authselect features in the custom profile'
-  ansible.builtin.command:
-    cmd: authselect enable-feature {{ item }}
-  loop: "{{ result_authselect_features.stdout_lines }}"
-  register: result_pam_authselect_restore_features
-  when:
-    - result_authselect_profile is not skipped
-    - result_authselect_features is not skipped
-    - result_pam_authselect_select_profile is not skipped
-
 {{{ ansible_apply_authselect_changes('after-hardening-custom-profile', rule_title=rule_title) }}}
   when:
     - result_authselect_check_cmd is success
     - result_authselect_profile is not skipped
-    - result_pam_authselect_restore_features is not skipped
 {{%- endmacro %}}
 
 
diff --git a/shared/macros/10-bash.jinja b/shared/macros/10-bash.jinja
index 4feaa7a0bdc..c9b0b5d7bc8 100644
--- a/shared/macros/10-bash.jinja
+++ b/shared/macros/10-bash.jinja
@@ -2587,10 +2587,7 @@ if [[ ! $CURRENT_PROFILE == custom/* ]]; then
     authselect create-profile hardening -b $CURRENT_PROFILE
     CURRENT_PROFILE="custom/hardening"
     {{{ bash_apply_authselect_changes('before-hardening-custom-profile') | indent(4) }}}
-    authselect select $CURRENT_PROFILE
-    for feature in $ENABLED_FEATURES; do
-        authselect enable-feature $feature;
-    done
+    authselect select $CURRENT_PROFILE $ENABLED_FEATURES
     {{{ bash_apply_authselect_changes('after-hardening-custom-profile') | indent(4) }}}
 fi
 {{%- endmacro %}}