Merge pull request #3422 from edx/jibsheet/disable-automated-upgrade-16.04

Jibsheet/disable automated upgrade 16.04

playbooks/roles/security/tasks/security-ubuntu.yml

@@ -22,6 +22,13 @@
     mode: "0644"
   when: SECURITY_UNATTENDED_UPGRADES
 
+- name: Disable unattended-upgrades if Xenial (16.04)
+  command: "{{ item }}"
+  when: ansible_distribution_release == 'xenial' and not SECURITY_UNATTENDED_UPGRADES
+  with_items:
+    - "systemctl disable apt-daily.service"
+    - "systemctl disable apt-daily.timer"
+
 - name: Disable unattended-upgrades
   file:
     path: "/etc/apt/apt.conf.d/10periodic"
@@ -85,4 +92,4 @@
     name: libc6
     state: latest
     update_cache: yes
-  when: "'vulnerable' in test_ghost_vuln.stdout"
\ No newline at end of file
+  when: "'vulnerable' in test_ghost_vuln.stdout"

playbooks/roles/xqwatcher/tasks/code_jail.yml

@@ -15,6 +15,8 @@
 # Do this first so symlinks can be resolved in the next step
 - name: Create jail virtualenv
   shell: "/usr/local/bin/virtualenv --python={{ item.PYTHON_EXECUTABLE }} --no-site-packages {{ xqwatcher_app_dir }}/venvs/{{ item.QUEUE_CONFIG.HANDLERS[0].CODEJAIL.name }}"
+  args:
+    creates: "{{ xqwatcher_app_dir }}/venvs/{{ item.QUEUE_CONFIG.HANDLERS[0].CODEJAIL.name }}/bin/pip"
   with_items: "{{ XQWATCHER_COURSES }}"
   tags:
     - install