sysctl control improvements

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_1/cis_1.5.x.yml

@@ -32,10 +32,13 @@
       - rule_1.5.2
 
 - name: "1.5.3 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-kernel_sysctl.conf"
-  notify:
-      - update sysctl
+  block:
+      - name: "1.5.3 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
+        set_fact:
+            sysctl_update: true
+      - name: "1.5.3 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-kernel_sysctl.conf"
   when:
       - rhel9cis_rule_1_5_3
   tags:

tasks/section_3/cis_3.1.x.yml

@@ -3,11 +3,15 @@
 # The CIS Control wants IPv6 disabled if not in use.
 # We are using the rhel9cis_ipv6_required to specify if you have IPv6 in use
 - name: "3.1.1 | PATCH | Verify if IPv6 is enabled on the system"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf"
-      notify:
-          - update sysctl
-          - sysctl flush ipv6 route table
+  block:
+      - name: "3.1.1 | PATCH | Verify if IPv6 is enabled on the system"
+        set_fact:
+            sysctl_update: true
+            flush_ipv6_route: true
+
+      - name: "3.1.1 | PATCH | Verify if IPv6 is enabled on the system"
+        debug: 
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf"
   when:
       - not rhel9cis_ipv6_required
       - rhel9cis_rule_3_1_1

tasks/section_3/cis_3.2.x.yml

@@ -2,19 +2,22 @@
 
 - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled"
   block:
+      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
       - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
         debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-        notify:
-            - update sysctl
-            - sysctl flush ipv4 route table
+      - block:
+          - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding | Set Fact"
+            set_fact:
+                flush_ipv6_route: true
 
-      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
-        debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
-        notify:
-            - update sysctl
-            - sysctl flush ipv6 route table
+          - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
+            debug:
+                msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
+        
         when: rhel9cis_ipv6_required
   when:
       - not rhel9cis_is_router
@@ -28,11 +31,14 @@
       - rule_3.2.1
 
 - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-  notify:
-      - update sysctl
-      - sysctl flush ipv4 route table
+  block:
+      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   when:
       - not rhel9cis_is_router
       - rhel9cis_rule_3_2_2

tasks/section_3/cis_3.3.x.yml

@@ -2,19 +2,23 @@
 
 - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
   block:
-      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
+      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv4 | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv4"
         debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-        notify:
-            - update sysctl
-            - sysctl flush ipv4 route table
 
-      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted"
-        debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
-        notify:
-            - sysctl flush ipv6 route table
-            - update sysctl
+      - block:
+          - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv6 | Set Fact"
+            set_fact:
+                flush_ipv6_route: true
+
+          - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv6"
+            debug:
+                msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
+        
         when: rhel9cis_ipv6_required
   when:
       - rhel9cis_rule_3_3_1
@@ -27,19 +31,23 @@
 
 - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
   block:
-      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
+      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv4 | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+
+      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv4"
         debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-        notify:
-            - update sysctl
-            - sysctl flush ipv4 route table
 
-      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted"
-        debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
-        notify:
-            - sysctl flush ipv6 route table
-            - update sysctl
+      - block:
+          - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv6 | Set Fact"
+            set_fact:
+              flush_ipv6_route: true
+
+          - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv6"
+            debug:
+                msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
         when: rhel9cis_ipv6_required
   when:
       - rhel9cis_rule_3_3_2
@@ -51,9 +59,14 @@
       - rule_3.3.2
 
 - name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-  notify: update sysctl
+  block:
+      - name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+      - name: "3.3.3 | PATCH | Ensure secure ICMP redirects are not accepted"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   when:
       - rhel9cis_rule_3_3_3
   tags:
@@ -64,9 +77,14 @@
       - rule_3.3.3
 
 - name: "3.3.4 | PATCH | Ensure suspicious packets are logged"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-  notify: update sysctl
+  block:
+      - name: "3.3.4 | PATCH | Ensure suspicious packets are logged | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+      - name: "3.3.4 | PATCH | Ensure suspicious packets are logged"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   when:
       - rhel9cis_rule_3_3_4
   tags:
@@ -77,9 +95,14 @@
       - rule_3.3.4
 
 - name: "3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-  notify: update sysctl
+  block:
+      - name: "3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+      - name: 3.3.5 | PATCH | Ensure broadcast ICMP requests are ignored"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   when:
       - rhel9cis_rule_3_3_5
   tags:
@@ -90,9 +113,15 @@
       - rule_3.3.5
 
 - name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-  notify: update sysctl
+  block:
+      - name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+
+      - name: "3.3.6 | PATCH | Ensure bogus ICMP responses are ignored"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   when:
       - rhel9cis_rule_3_3_6
   tags:
@@ -103,9 +132,14 @@
       - rule_3.3.6
 
 - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-  notify: update sysctl
+  block:
+      - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+      - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   when:
       - rhel9cis_rule_3_3_7
   tags:
@@ -116,9 +150,14 @@
       - rule_3.3.7
 
 - name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled"
-  debug:
-      msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-  notify: update sysctl
+  block:
+      - name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv4_route: true
+      - name: "3.3.8 | PATCH | Ensure TCP SYN Cookies is enabled"
+        debug:
+            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
   when:
       - rhel9cis_rule_3_3_8
   tags:
@@ -130,20 +169,14 @@
 
 - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
   block:
-      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
-        debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-        notify:
-            - update sysctl
-            - sysctl flush ipv4 route table
+      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted | IPv6 | Set Fact"
+        set_fact:
+            sysctl_update: true
+            flush_ipv6_route: true
 
-      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted"
+      - name: "3.3.9 | PATCH | Ensure IPv6 router advertisements are not accepted | IPv6"
         debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl"
-        notify:
-            - sysctl flush ipv6 route table
-            - update sysctl
-        when: rhel9cis_ipv6_required
   when:
       - rhel9cis_ipv6_required
       - rhel9cis_rule_3_3_9