Systemd timer template enable masked timers

[teacup-on-rockingchair]

Description:

• In case the timer we must enable is masked the template should cover that case also

Rationale:

• Make sure ansible and bash remediations unmask the timer that should be enabled
• Add a small fail test when timer is masked

[Copilot]

🟢 Approval recommended

The changes are minimal, consistent with existing systemd remediation patterns in the repo, and include a targeted test covering the masked-timer scenario.

Pull request overview

Updates the timer_enabled template so remediations correctly handle the case where the target systemd timer is masked, and adds a regression test to ensure a masked timer is detected as noncompliant and fixed by remediation.

Changes:

• Add systemctl unmask to the bash remediation before starting/enabling the timer.
• Ensure the Ansible remediation explicitly unmasks the timer via masked: "no".
• Add a new failing test scenario that masks the timer (timer_masked.fail.sh).

File summaries

File	Description
shared/templates/timer_enabled/tests/timer_masked.fail.sh	Adds a failing test setup that stops and masks the timer to validate remediation handles masked units.
shared/templates/timer_enabled/bash.template	Unmasks the timer prior to start/enable to handle the masked-unit edge case.
shared/templates/timer_enabled/ansible.template	Adds masked: "no" to ensure the timer is unmasked when enabling/starting via Ansible.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Mab879]

One minor change