ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

updated logic on 7.2.9

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2025-02-07 12:20:45 +00:00
parent 48cad82265
commit 49807a096b
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
1 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
tasks/section_7/cis_7.2.x.yml
View file

@ -287,15 +287,15 @@
warn_control_id: '7.2.9' warn_control_id: '7.2.9'
block: block:
- name: "7.2.9 | AUDIT | Ensure local interactive user dot files access is configured | Check for files" - name: "7.2.9 | AUDIT | Ensure local interactive user dot files access is configured | Check for files"
ansible.builtin.shell: find /home/ -name "\.*" -perm /g+w,o+w ansible.builtin.shell: find /home/ -name "\.*"
changed_when: false changed_when: false
failed_when: discovered_homedir_dot_files.rc not in [ 0, 1 ] failed_when: discovered_homedir_hidden_files.rc not in [ 0, 1 ]
check_mode: false check_mode: false
register: discovered_homedir_dot_files register: discovered_homedir_hidden_files
- name: "7.2.9 | AUDIT | Ensure local interactive user dot files access is configured | Warning on files found" - name: "7.2.9 | AUDIT | Ensure local interactive user dot files access is configured | Warning on files found"
when: when:
- discovered_homedir_dot_files.stdout | length > 0 - discovered_homedir_hidden_files.stdout | length > 0
- rhel9cis_dotperm_ansiblemanaged - rhel9cis_dotperm_ansiblemanaged
ansible.builtin.debug: ansible.builtin.debug:
msg: msg:
@ -303,16 +303,18 @@
- name: "7.2.9 | PATCH | Ensure local interactive user dot files access is configured | Set warning count" - name: "7.2.9 | PATCH | Ensure local interactive user dot files access is configured | Set warning count"
when: when:
- discovered_homedir_dot_files.stdout | length > 0 - discovered_homedir_hidden_files.stdout | length > 0
- rhel9cis_dotperm_ansiblemanaged - rhel9cis_dotperm_ansiblemanaged
ansible.builtin.import_tasks: ansible.builtin.import_tasks:
file: warning_facts.yml file: warning_facts.yml
- name: "7.2.9 | PATCH | Ensure local interactive user dot files access is configured | Changes files if configured" - name: "7.2.9 | PATCH | Ensure local interactive user dot files access is configured | Changes files if configured"
when: when:
- discovered_homedir_dot_files.stdout | length > 0 - discovered_homedir_hidden_files.stdout | length > 0
- rhel9cis_dotperm_ansiblemanaged - rhel9cis_dotperm_ansiblemanaged
ansible.builtin.file: ansible.builtin.file:
path: '{{ item }}' path: '{{ item }}'
mode: 'go-w' mode: 'go-w'
with_items: "{{ discovered_homedir_dot_files.stdout_lines }}" owner: "{{ rhel9cis_passwd | selectattr('dir', 'in', prelim_interactive_users_home.stdout_lines) | selectattr('dir', 'in', item) | map(attribute='uid') | last }}"
group: "{{ rhel9cis_passwd | selectattr('dir', 'in', prelim_interactive_users_home.stdout_lines) | selectattr('dir', 'in', item) | map(attribute='gid') | last }}"
with_items: "{{ discovered_homedir_hidden_files.stdout_lines }}"