From 28ca5d18b3f6f23c5f364e3bbcefd65d97adeccd Mon Sep 17 00:00:00 2001 From: John Foster Date: Fri, 8 Mar 2024 08:44:04 +0000 Subject: [PATCH] Fixed issues with 4.1.1.2 and 4.1.1.3 Now handle multiple kernels and are idempotent Removed debug messages Signed-off-by: John Foster --- tasks/section_4/cis_4.1.1.x.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/tasks/section_4/cis_4.1.1.x.yml b/tasks/section_4/cis_4.1.1.x.yml index cf3d66d..3d0082a 100644 --- a/tasks/section_4/cis_4.1.1.x.yml +++ b/tasks/section_4/cis_4.1.1.x.yml @@ -31,10 +31,6 @@ check_mode: false register: rhel9cis_4_1_1_2_grubby_curr_value_audit_linux - - name: Show list - ansible.builtin.debug: - msg: "var: \n{{ rhel9cis_4_1_1_2_grubby_curr_value_audit_linux }}" - - name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby update, if needed" ansible.builtin.shell: grubby --update-kernel=ALL --args="audit=1" when: @@ -75,10 +71,6 @@ - (item | int < rhel9cis_audit_back_log_limit) loop: "{{ rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux.stdout_lines }}" - - name: Show list - ansible.builtin.debug: - msg: "var: \n{{ rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux }}\ntrigger reset: {{ rhel9cis_4_1_1_3_reset_backlog_limits | default(false)}}" - - name: "4.1.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby update applied" ansible.builtin.shell: cmd: 'grubby --update-kernel=ALL --args="audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}"'