ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

moved some controls to handlers

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-07-29 17:08:38 +01:00
parent 4f68cf1f92
commit 084e6c6760
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
2 changed files with 31 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

21
tasks/auditd.yml
View file

@ -6,7 +6,10 @@
group: root
mode: 0600
register: audit_rules_updated
notify: restart auditd
notify:
- auditd_immutable_check
- audit_immutable_fact
- restart auditd
- name: POST | Set up auditd user logging exceptions
template:
@ -19,19 +22,3 @@
when:
- allow_auditd_uid_user_exclusions
- rhel9cis_auditd_uid_exclude | length > 0
- name: POST | AUDITD | Discover if auditd immutable - Set reboot required if auditd immutable
block:
- name: POST | AUDITD | Discover if auditd immutable - will require reboot if auditd template applied
shell: grep -c "^-e 2" /etc/audit/rules.d/99_auditd.rules
changed_when: false
register: auditd_immutable_check
- name: POST | AUDITD | Set reboot required if auditd immutable
debug:
msg: "Reboot required for auditd to apply new rules as immutable set"
notify: change_requires_reboot
when:
- auditd_immutable_check.stdout == '1'
when:
- audit_rules_updated.changed