mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
addition of audit_only config
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
8784941179
commit
23a4386e95
5 changed files with 103 additions and 49 deletions
|
|
@ -1,12 +1,12 @@
|
|||
---
|
||||
|
||||
- name: "Post Audit | Run post_remediation {{ benchmark }} audit"
|
||||
- name: Post Audit | Run post_remediation {{ benchmark }} audit
|
||||
ansible.builtin.shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ post_audit_outfile }} -g {{ group_names }}"
|
||||
changed_when: true
|
||||
environment:
|
||||
AUDIT_BIN: "{{ audit_bin }}"
|
||||
AUDIT_CONTENT_LOCATION: "{{ audit_out_dir }}"
|
||||
AUDIT_FILE: "goss.yml"
|
||||
AUDIT_FILE: goss.yml
|
||||
|
||||
- name: Post Audit | ensure audit files readable by users
|
||||
ansible.builtin.file:
|
||||
|
|
@ -18,9 +18,11 @@
|
|||
- "{{ pre_audit_outfile }}"
|
||||
|
||||
- name: Post Audit | Capture audit data if json format
|
||||
when:
|
||||
- audit_format == "json"
|
||||
block:
|
||||
- name: "capture data {{ post_audit_outfile }}"
|
||||
ansible.builtin.shell: "cat {{ post_audit_outfile }}"
|
||||
- name: capture data {{ post_audit_outfile }}
|
||||
ansible.builtin.shell: cat {{ post_audit_outfile }}
|
||||
register: post_audit
|
||||
changed_when: false
|
||||
|
||||
|
|
@ -28,19 +30,17 @@
|
|||
ansible.builtin.set_fact:
|
||||
post_audit_summary: "{{ post_audit.stdout | from_json | json_query(summary) }}"
|
||||
vars:
|
||||
summary: 'summary."summary-line"'
|
||||
when:
|
||||
- audit_format == "json"
|
||||
summary: summary."summary-line"
|
||||
|
||||
- name: Post Audit | Capture audit data if documentation format
|
||||
when:
|
||||
- audit_format == "documentation"
|
||||
block:
|
||||
- name: "Post Audit | capture data {{ post_audit_outfile }}"
|
||||
ansible.builtin.shell: "tail -2 {{ post_audit_outfile }}"
|
||||
- name: Post Audit | capture data {{ post_audit_outfile }}
|
||||
ansible.builtin.shell: tail -2 {{ post_audit_outfile }}
|
||||
register: post_audit
|
||||
changed_when: false
|
||||
|
||||
- name: Post Audit | Capture post-audit result
|
||||
ansible.builtin.set_fact:
|
||||
post_audit_summary: "{{ post_audit.stdout_lines }}"
|
||||
when:
|
||||
- audit_format == "documentation"
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue