Lint updates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_4/cis_4.1.x.yml

@@ -52,7 +52,7 @@
         name: "{{ rhel9cis_firewall }}"
         state: installed
 
-    - name: "4.1.2 | PATCH | Ensure a single firewall configuration utility is in use | {{ rhel9cis_firewall }} started and enabled"
+    - name: "4.1.2 | PATCH | Ensure a single firewall configuration utility is in use | {{ rhel9cis_firewall }} started and enabled"  # noqa name[template]
       ansible.builtin.systemd:
         name: "{{ rhel9cis_firewall }}"
         enabled: true

tasks/section_4/cis_4.3.x.yml

@@ -8,7 +8,8 @@
     - rhel9cis_rule_4_3_3
     - rhel9cis_rule_4_3_4
   tags: always
-  ansible.builtin.shell: "nft add table inet {{ rhel9cis_nft_tables_tablename }}"
+  ansible.builtin.command: "nft add table inet {{ rhel9cis_nft_tables_tablename }}"
+  changed_when: true
 
 - name: "4.3.1 | PATCH | Ensure nftables base chains exist"
   when:
@@ -22,19 +23,22 @@
     - NIST800-55_CA-9
   block:
     - name: "4.3.1 | AUDIT | Ensure nftables base chains exist | Get current chains for INPUT"
-      ansible.builtin.shell: nft list ruleset | grep 'hook input'
+      ansible.builtin.shell: |
+        nft list ruleset | grep 'hook input'
       changed_when: false
       failed_when: false
       register: discovered_nftables_input_chains
 
     - name: "4.3.1 | AUDIT | Ensure nftables base chains exist | Get current chains for FORWARD"
-      ansible.builtin.shell: nft list ruleset | grep 'hook forward'
+      ansible.builtin.shell: |
+        nft list ruleset | grep 'hook forward'
       changed_when: false
       failed_when: false
       register: discovered_nftables_forward_chains
 
     - name: "4.3.1 | AUDIT | Ensure nftables base chains exist | Get current chains for OUTPUT"
-      ansible.builtin.shell: nft list ruleset | grep 'hook output'
+      ansible.builtin.shell: |
+        nft list ruleset | grep 'hook output'
       changed_when: false
       failed_when: false
       register: discovered_nftables_output_chains
@@ -52,7 +56,8 @@
 
     - name: "4.3.1 | PATCH | Ensure nftables base chains exist | Create chains if needed"
       when: rhel9cis_nft_tables_autochaincreate
-      ansible.builtin.shell: "{{ item }}"
+      ansible.builtin.command: "{{ item }}"
+      changed_when: true
       failed_when: false
       loop:
         - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; }
@@ -71,44 +76,50 @@
     - NIST800-55_CA-9
   block:
     - name: "4.3.2 | AUDIT | Ensure nftables established connections are configured | Gather incoming connection rules"
-      ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
+      ansible.builtin.shell: |
+        nft list ruleset | awk '/hook input/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
       changed_when: false
       failed_when: false
       register: discovered_nftables_inconnectionrule
 
     - name: "4.3.2 | AUDIT | Ensure nftables established connections are configured | Gather outbound connection rules"
-      ansible.builtin.shell: nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
+      ansible.builtin.command: nft list ruleset | awk '/hook output/,/}/' | grep -E 'ip protocol (tcp|udp|icmp) ct state'
       changed_when: false
       failed_when: false
       register: discovered_nftables_outconnectionrule
 
     - name: "4.3.2| PATCH | Ensure nftables established connections are configured | Add input tcp established accept policy"
       when: '"ip protocol tcp ct state established accept" not in discovered_nftables_inconnectionrule.stdout'
-      ansible.builtin.shell: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept
+      ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol tcp ct state established accept
+      changed_when: true
 
     - name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add input udp established accept policy"
       when: '"ip protocol udp ct state established accept" not in discovered_nftables_inconnectionrule.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol udp ct state established accept
+      changed_when: true
 
     - name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add input icmp established accept policy"
       when: '"ip protocol icmp ct state established accept" not in discovered_nftables_inconnectionrule.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip protocol icmp ct state established accept
+      changed_when: true
 
     - name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add output tcp new, related, established accept policy"
       when: '"ip protocol tcp ct state established,related,new accept" not in discovered_nftables_outconnectionrule.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol tcp ct state new,related,established accept
+      changed_when: true
 
     - name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add output udp new, related, established accept policy"
       when: '"ip protocol udp ct state established,related,new accept" not in discovered_nftables_outconnectionrule.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol udp ct state new,related,established accept
+      changed_when: true
 
     - name: "4.3.2 | PATCH | Ensure nftables established connections are configured | Add output icmp new, related, established accept policy"
       when: '"ip protocol icmp ct state established,related,new accept" not in discovered_nftables_outconnectionrule.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" output ip protocol icmp ct state new,related,established accept
+      changed_when: true
 
 - name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy"
-  when:
-    - rhel9cis_rule_4_3_3
+  when: rhel9cis_rule_4_3_3
   tags:
     - level1-server
     - level1-workstation
@@ -118,25 +129,29 @@
     - NIST800-55_CA-9
   block:
     - name: "4.3.3 | AUDIT | Ensure nftables default deny firewall policy | Check for hook input deny policy"
-      ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook input'
+      ansible.builtin.shell: |
+        nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook input'
       failed_when: false
       changed_when: false
       register: discovered_nftables_inputpolicy
 
     - name: "4.3.3 | AUDIT | Ensure nftables default deny firewall policy | Check for hook forward deny policy"
-      ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook forward'
+      ansible.builtin.shell: |
+        nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook forward'
       failed_when: false
       changed_when: false
       register: discovered_nftables_forwardpolicy
 
     - name: "4.3.3 | AUDIT | Ensure nftables default deny firewall policy | Check for hook output deny policy"
-      ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook output'
+      ansible.builtin.shell: |
+        nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'hook output'
       failed_when: false
       changed_when: false
       register: discovered_nftables_outputpolicy
 
     - name: "4.3.3 | AUDIT | Ensure nftables default deny firewall policy | Check for SSH allow"
-      ansible.builtin.shell: nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'ssh'
+      ansible.builtin.shell: |
+        nft list table inet "{{ rhel9cis_nft_tables_tablename }}" | grep 'ssh'
       failed_when: false
       changed_when: false
       register: discovered_nftables_sshallowcheck
@@ -144,22 +159,25 @@
     - name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Enable SSH traffic"
       when: '"tcp dport ssh accept" not in discovered_nftables_sshallowcheck.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input tcp dport ssh accept
+      changed_when: true
 
     - name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Set hook input deny policy"
       when: '"type filter hook input priority 0; policy drop;" not in discovered_nftables_inputpolicy.stdout'
       ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" input { policy drop \; }
+      changed_when: true
 
     - name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Create hook forward deny policy"
       when: '"type filter hook forward priority 0; policy drop;" not in discovered_nftables_forwardpolicy.stdout'
       ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { policy drop \; }
+      changed_when: true
 
     - name: "4.3.3 | PATCH | Ensure nftables default deny firewall policy | Create hook output deny policy"
       when: '"type filter hook output priority 0; policy drop;" not in discovered_nftables_outputpolicy.stdout'
       ansible.builtin.command: nft chain inet "{{ rhel9cis_nft_tables_tablename }}" output { policy drop \; }
+      changed_when: true
 
 - name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured"
-  when:
-    - rhel9cis_rule_4_3_4
+  when: rhel9cis_rule_4_3_4
   tags:
     - level1-server
     - level1-workstation
@@ -169,19 +187,22 @@
     - NIST800-55_CA-9
   block:
     - name: "4.3.4 | AUDIT | Ensure nftables loopback traffic is configured | Gather iif lo accept existence | nftables"
-      ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept'
+      ansible.builtin.shell: |
+        nft list ruleset | awk '/hook input/,/}/' | grep 'iif "lo" accept'
       changed_when: false
       failed_when: false
       register: discovered_nftables_iiflo
 
     - name: "4.3.4 | AUDIT | Ensure nftables loopback traffic is configured | Gather ip saddr existence | nftables"
-      ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
+      ansible.builtin.shell: |
+        nft list ruleset | awk '/hook input/,/}/' | grep 'ip saddr'
       changed_when: false
       failed_when: false
       register: discovered_nftables_ipsaddr
 
     - name: "4.3.4 | AUDIT | Ensure nftables loopback traffic is configured | Gather ip6 saddr existence | nftables"
-      ansible.builtin.shell: nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'
+      ansible.builtin.shell: |
+        nft list ruleset | awk '/hook input/,/}/' | grep 'ip6 saddr'
       changed_when: false
       failed_when: false
       register: discovered_nftables_ip6saddr
@@ -189,11 +210,14 @@
     - name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured | Set iif lo accept rule | nftables"
       when: '"iif \"lo\" accept" not in discovered_nftables_iiflo.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input iif lo accept
+      changed_when: true
 
     - name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured | Set ip sddr rule | nftables"
       when: '"ip saddr 127.0.0.0/8 counter packets 0 bytes 0 drop" not in discovered_nftables_ipsaddr.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip saddr 127.0.0.0/8 counter drop
+      changed_when: true
 
     - name: "4.3.4 | PATCH | Ensure nftables loopback traffic is configured | Set ip6 saddr rule | nftables"
       when: '"ip6 saddr ::1 counter packets 0 bytes 0 drop" not in discovered_nftables_ip6saddr.stdout'
       ansible.builtin.command: nft add rule inet "{{ rhel9cis_nft_tables_tablename }}" input ip6 saddr ::1 counter drop
+      changed_when: true