ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 14:23:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

selinux updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-04-11 17:38:26 +01:00
parent 08e48fbe83
commit 4bd971fdcd
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
1 changed files with 18 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

53
tasks/section_1/cis_1.6.1.x.yml
View file

@ -47,8 +47,7 @@
- patch
- rule_1.6.1.3
# State set to enforcing because control 1.6.1.5 requires enforcing to be set
- name: "1.6.1.4 | PATCH | Ensure the SELinux mode is not disabled"
- name: "1.6.1.4 | PATCH | Ensure the SELinux state is enforcing"
selinux:
conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}"
@ -56,80 +55,64 @@
when:
- not rhel9cis_selinux_disable
- rhel9cis_rule_1_6_1_4
tags:
- level1-server
- level1-workstation
- auotmated
- selinux
- patch
- rule_1.6.1.4
- name: "1.6.1.5 | PATCH | Ensure the SELinux state is enforcing"
selinux:
conf: /etc/selinux/config
policy: "{{ rhel9cis_selinux_pol }}"
state: enforcing
when:
- not rhel9cis_selinux_disable
- rhel9cis_rule_1_6_1_5
tags:
- level2-server
- level2-workstation
- automated
- selinux
- patch
- rule_1.6.1.5
- rule_1.6.1.4
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist"
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist"
block:
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Find the unconfined services"
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | Find the unconfined services"
shell: ps -eZ | grep unconfined_service_t | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
register: rhelcis_1_6_1_6_unconf_services
register: rhelcis_1_6_1_5_unconf_services
failed_when: false
changed_when: false
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Message on no unconfined services"
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | Message on no unconfined services"
debug:
msg: "Good News! There are no services found on your system"
when: rhelcis_1_6_1_6_unconf_services.stdout | length == 0
when: rhelcis_1_6_1_5_unconf_services.stdout | length == 0
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Message on unconfined services"
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | Message on unconfined services"
debug:
msg: "Warning! You have unconfined services: {{ rhelcis_1_6_1_6_unconf_services.stdout_lines }}"
when: rhelcis_1_6_1_6_unconf_services.stdout | length > 0
msg: "Warning! You have unconfined services: {{ rhelcis_1_6_1_5_unconf_services.stdout_lines }}"
when: rhelcis_1_6_1_5_unconf_services.stdout | length > 0
when:
- rhel9cis_rule_1_6_1_6
- rhel9cis_rule_1_6_1_5
tags:
- level1-server
- level1-workstation
- automated
- audit
- services
- rule_1.6.1.6
- rule_1.6.1.5
- name: "1.6.1.7 | PATCH | Ensure SETroubleshoot is not installed"
- name: "1.6.1.6 | PATCH | Ensure SETroubleshoot is not installed"
package:
name: setroubleshoot
state: absent
when:
- rhel9cis_rule_1_6_1_7
- rhel9cis_rule_1_6_1_6
- "'setroubleshoot' in ansible_facts.packages"
tags:
- level1-server
- automated
- selinux
- patch
- rule_1.6.1.7
- rule_1.6.1.6
- name: "1.6.1.8 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
- name: "1.6.1.7 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
package:
name: mcstrans
state: absent
when:
- rhel9cis_rule_1_6_1_8
- rhel9cis_rule_1_6_1_7
tags:
- level1-server
- level1-workstation
- automated
- patch
- rule_1.6.1.8
- rule_1.6.1.7