ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

variable naming

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-03-01 10:17:37 +00:00
parent 58d3bb4e41
commit 03e4b0e57f
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
3 changed files with 10 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

4
handlers/main.yml
View file

@ -13,7 +13,7 @@
sysctl_set: true sysctl_set: true
ignore_errors: true # noqa ignore-errors ignore_errors: true # noqa ignore-errors
when: when:
- flush_ipv4_route - rhel9cis_flush_ipv4_route
- not system_is_container - not system_is_container
- name: Sysctl flush ipv6 route table - name: Sysctl flush ipv6 route table
@ -22,7 +22,7 @@
value: '1' value: '1'
sysctl_set: true sysctl_set: true
when: when:
- flush_ipv6_route - rhel9cis_flush_ipv6_route
- not system_is_container - not system_is_container
- name: Systemd restart tmp.mount - name: Systemd restart tmp.mount

14
tasks/auditd.yml
View file

@ -3,7 +3,7 @@
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file - name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
ansible.builtin.stat: ansible.builtin.stat:
path: /etc/audit/rules.d/99_auditd.rules path: /etc/audit/rules.d/99_auditd.rules
register: auditd_file register: rhel9cis_auditd_file
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | setup file - name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | setup file
ansible.builtin.template: ansible.builtin.template:
@ -12,8 +12,8 @@
owner: root owner: root
group: root group: root
mode: 0640 mode: 0640
diff: "{{ auditd_file.stat.exists }}" # Only run diff if not a new file diff: "{{ rhel9cis_auditd_file.stat.exists }}" # Only run diff if not a new file
register: auditd_template_updated register: rhel9cis_auditd_template_updated
notify: notify:
- Auditd immutable check - Auditd immutable check
- Audit immutable fact - Audit immutable fact
@ -24,13 +24,13 @@
vars: vars:
warn_control_id: 'Auditd template updated, see diff output for details' warn_control_id: 'Auditd template updated, see diff output for details'
when: when:
- auditd_template_updated.changed - rhel9cis_auditd_template_updated.changed
- auditd_file.stat.exists - rhel9cis_auditd_file.stat.exists
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file - name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
ansible.builtin.stat: ansible.builtin.stat:
path: /etc/audit/rules.d/98_auditd_exceptions.rules path: /etc/audit/rules.d/98_auditd_exceptions.rules
register: auditd_exception_file register: rhel9cis_auditd_exception_file
- name: POST | Set up auditd user logging exceptions | setup file - name: POST | Set up auditd user logging exceptions | setup file
ansible.builtin.template: ansible.builtin.template:
@ -39,7 +39,7 @@
owner: root owner: root
group: root group: root
mode: 0640 mode: 0640
diff: "{{ auditd_exception_file.stat.exists }}" diff: "{{ rhel9cis_auditd_exception_file.stat.exists }}"
notify: Restart auditd notify: Restart auditd
when: when:
- rhel9cis_allow_auditd_uid_user_exclusions - rhel9cis_allow_auditd_uid_user_exclusions

2
tasks/post.yml
View file

@ -22,7 +22,7 @@
- 60-netipv4_sysctl.conf - 60-netipv4_sysctl.conf
- 60-netipv6_sysctl.conf - 60-netipv6_sysctl.conf
when: when:
- sysctl_update - rhel9cis_sysctl_update
- not system_is_container - not system_is_container
- "'procps-ng' in ansible_facts.packages" - "'procps-ng' in ansible_facts.packages"