mirror of
https://github.com/ansible-lockdown/RHEL9-CIS.git
synced 2025-12-24 22:23:06 +00:00
lint and v2 initial
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
42aa624d50
commit
a36a84c5ea
5 changed files with 712 additions and 676 deletions
|
|
@ -2,46 +2,46 @@
|
|||
|
||||
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
|
||||
ansible.builtin.stat:
|
||||
path: /etc/audit/rules.d/99_auditd.rules
|
||||
path: /etc/audit/rules.d/99_auditd.rules
|
||||
register: rhel9cis_auditd_file
|
||||
|
||||
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | setup file
|
||||
ansible.builtin.template:
|
||||
src: audit/99_auditd.rules.j2
|
||||
dest: /etc/audit/rules.d/99_auditd.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
src: audit/99_auditd.rules.j2
|
||||
dest: /etc/audit/rules.d/99_auditd.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
diff: "{{ rhel9cis_auditd_file.stat.exists }}" # Only run diff if not a new file
|
||||
register: rhel9cis_auditd_template_updated
|
||||
notify:
|
||||
- Auditd immutable check
|
||||
- Audit immutable fact
|
||||
- Restart auditd
|
||||
- Auditd immutable check
|
||||
- Audit immutable fact
|
||||
- Restart auditd
|
||||
|
||||
- name: POST | AUDITD | Add Warning count for changes to template file | Warn Count # noqa no-handler
|
||||
ansible.builtin.import_tasks:
|
||||
file: warning_facts.yml
|
||||
vars:
|
||||
warn_control_id: 'Auditd template updated, see diff output for details'
|
||||
when:
|
||||
- rhel9cis_auditd_template_updated.changed
|
||||
- rhel9cis_auditd_file.stat.exists
|
||||
- rhel9cis_auditd_template_updated.changed
|
||||
- rhel9cis_auditd_file.stat.exists
|
||||
ansible.builtin.import_tasks:
|
||||
file: warning_facts.yml
|
||||
vars:
|
||||
warn_control_id: 'Auditd template updated, see diff output for details'
|
||||
|
||||
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
|
||||
ansible.builtin.stat:
|
||||
path: /etc/audit/rules.d/98_auditd_exceptions.rules
|
||||
path: /etc/audit/rules.d/98_auditd_exceptions.rules
|
||||
register: rhel9cis_auditd_exception_file
|
||||
|
||||
- name: POST | Set up auditd user logging exceptions | setup file
|
||||
when:
|
||||
- rhel9cis_allow_auditd_uid_user_exclusions
|
||||
- rhel9cis_auditd_uid_exclude | length > 0
|
||||
ansible.builtin.template:
|
||||
src: audit/98_auditd_exception.rules.j2
|
||||
dest: /etc/audit/rules.d/98_auditd_exceptions.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
src: audit/98_auditd_exception.rules.j2
|
||||
dest: /etc/audit/rules.d/98_auditd_exceptions.rules
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0640'
|
||||
diff: "{{ rhel9cis_auditd_exception_file.stat.exists }}"
|
||||
notify: Restart auditd
|
||||
when:
|
||||
- rhel9cis_allow_auditd_uid_user_exclusions
|
||||
- rhel9cis_auditd_uid_exclude | length > 0
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue