Merge pull request #1 from ansible-lockdown/benchmark_v2.0.0

Added ARM support for audit

.github/workflows/devel_pipeline_validation.yml

@@ -27,7 +27,7 @@
   jobs:
     # This will create messages for first time contributers and direct them to the Discord server
       welcome:
-        runs-on: self-hosted
+        runs-on: ubuntu-latest
 
         steps:
             - uses: actions/first-interaction@main

.github/workflows/main_pipeline_validation.yml

@@ -23,18 +23,6 @@
   # A workflow run is made up of one or more jobs
   # that can run sequentially or in parallel
   jobs:
-    # This will create messages for first time contributers and direct them to the Discord server
-      welcome:
-        runs-on: self-hosted
-
-        steps:
-            - uses: actions/first-interaction@main
-              with:
-                repo-token: ${{ secrets.GITHUB_TOKEN }}
-                pr-message: |-
-                    Congrats on opening your first pull request and thank you for taking the time to help improve Ansible-Lockdown!
-                    Please join in the conversation happening on the [Discord Server](https://www.lockdownenterprise.com/discord) as well.
-
       # This workflow contains a single job that tests the playbook
       playbook-test:
         # The type of runner that the job will run on

tasks/LE_audit_setup.yml

@@ -3,16 +3,17 @@
 - name: Pre Audit Setup | Set audit package name
   block:
     - name: Pre Audit Setup | Set audit package name | 64bit
+      when: ansible_facts.machine == "x86_64"
       ansible.builtin.set_fact:
         audit_pkg_arch_name: AMD64
-      when: ansible_facts.machine == "x86_64"
 
     - name: Pre Audit Setup | Set audit package name | ARM64
+      when: ansible_facts.machine == "aarch64"
       ansible.builtin.set_fact:
         audit_pkg_arch_name: ARM64
-      when: ansible_facts.machine == "arm64"
 
 - name: Pre Audit Setup | Download audit binary
+  when: get_audit_binary_method == 'download'
   ansible.builtin.get_url:
     url: "{{ audit_bin_url }}{{ audit_pkg_arch_name }}"
     dest: "{{ audit_bin }}"
@@ -20,15 +21,12 @@
     group: root
     checksum: "{{ audit_bin_version[audit_pkg_arch_name + '_checksum'] }}"
     mode: '0555'
-  when:
-    - get_audit_binary_method == 'download'
 
 - name: Pre Audit Setup | Copy audit binary
+  when: get_audit_binary_method == 'copy'
   ansible.builtin.copy:
     src: "{{ audit_bin_copy_location }}"
     dest: "{{ audit_bin }}"
     mode: '0555'
     owner: root
     group: root
-  when:
-    - get_audit_binary_method == 'copy'

tasks/post_remediation_audit.yml

@@ -35,7 +35,7 @@
     - audit_format == "documentation"
   block:
     - name: Post Audit | Capture audit data if documentation format
-      ansible.builtin.shell: "tail -2 /opt/audit_ubuntu2204-CIS-UBUNTU22_1720624848.documentation"
+      ansible.builtin.shell: tail -2 "{{ post_audit_outfile }}" | tac | tr '\n' ' '
       register: post_audit_summary
       changed_when: false
 

tasks/pre_remediation_audit.yml

@@ -105,7 +105,7 @@
     - audit_format == "documentation"
   block:
     - name: Pre Audit | Capture audit data if documentation format
-      ansible.builtin.shell: tail -2 "{{ pre_audit_outfile }}"  | tac | tr '\n' ' '
+      ansible.builtin.shell: tail -2 "{{ pre_audit_outfile }}" | tac | tr '\n' ' '
       register: pre_audit_summary
       changed_when: false
 

tasks/section_6/cis_6.2.4.1.yml

@@ -27,6 +27,8 @@
       ansible.builtin.file:
         path: "{{ item }}"
         mode: 'u-x,g-wx,o-rwx'
+      failed_when: rhel9cis_logfile_list.state not in '[ file, absent ]'
+      register: rhel9cis_logfile_list
       loop: "{{ discovered_logfiles.stdout_lines }}"
 
     - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
@@ -36,6 +38,8 @@
       ansible.builtin.file:
         path: "{{ item }}"
         mode: 'u-x,g-x,o-rwx'
+      failed_when: rhel9cis_logfile_list.state not in '[ file, absent ]'
+      register: rhel9cis_logfile_list
       loop: "{{ discovered_logfiles.stdout_lines }}"
 
     - name: "6.2.4.1 | PATCH | Ensure access to all logfiles has been configured | change permissions"
@@ -49,4 +53,6 @@
       ansible.builtin.file:
         path: "{{ item }}"
         mode: 'ug-x,o-wx'
+      failed_when: rhel9cis_logfile_list.state not in '[ file, absent ]'
+      register: rhel9cis_logfile_list
       loop: "{{ discovered_logfiles.stdout_lines }}"

tasks/section_6/cis_6.3.4.x.yml

@@ -50,6 +50,8 @@
   ansible.builtin.file:
     path: "{{ item.path }}"
     mode: 'u-x,g-wx,o-rwx'
+  failed_when: rhel9cis_6_3_4_5_file_list.state not in '[ file, absent ]'
+  register: rhel9cis_6_3_4_5_file_list
   loop: "{{ prelim_auditd_conf_files.files }}"
   loop_control:
     label: "{{ item.path }}"
@@ -66,6 +68,8 @@
   ansible.builtin.file:
     path: "{{ item.path }}"
     owner: root
+  failed_when: rhel9cis_6_3_4_6_file_list.state not in '[ file, absent ]'
+  register: rhel9cis_6_3_4_6_file_list
   loop: "{{ prelim_auditd_conf_files.files | default([]) }}"
   loop_control:
     label: "{{ item.path }}"
@@ -82,6 +86,8 @@
   ansible.builtin.file:
     path: "{{ item.path }}"
     group: root
+  failed_when: rhel9cis_6_3_4_7_file_list.state not in '[ file, absent ]'
+  register: rhel9cis_6_3_4_7_file_list
   loop: "{{ prelim_auditd_conf_files.files | default([]) }}"
   loop_control:
     label: "{{ item.path }}"

vars/audit.yml

@@ -26,8 +26,9 @@ post_audit_outfile: "{{ audit_log_dir }}/{{ ansible_facts.hostname }}-{{ benchma
 
 ### Audit binary settings ###
 audit_bin_version:
-  release: v0.4.4
-  AMD64_checksum: 'sha256:1c4f54b22fde9d4d5687939abc2606b0660a5d14a98afcd09b04b793d69acdc5'
+  release: v0.4.8
+  AMD64_checksum: 'sha256:85d00b7bba5f175bec95de7dfe1f71f8f25204914aad4c6f03c8457868eb6e2f'
+  ARM64_checksum: 'sha256:bca8c898bfd35b94c51455ece6193c95e2cd7b2b183ac2047b2d76291e73e47d'
 audit_bin_path: /usr/local/bin/
 audit_bin: "{{ audit_bin_path }}goss"
 audit_format: json