lint and v2 initial

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

handlers/main.yml

@@ -5,23 +5,23 @@
   ansible.builtin.shell: sysctl --system
 
 - name: Sysctl flush ipv4 route table
+  when:
+    - rhel9cis_flush_ipv4_route
+    - not system_is_container
   ansible.posix.sysctl:
     name: net.ipv4.route.flush
     value: '1'
     sysctl_set: true
   ignore_errors: true  # noqa ignore-errors
-  when:
-      - rhel9cis_flush_ipv4_route
-      - not system_is_container
 
 - name: Sysctl flush ipv6 route table
+  when:
+    - rhel9cis_flush_ipv6_route
+    - not system_is_container
   ansible.posix.sysctl:
     name: net.ipv6.route.flush
     value: '1'
     sysctl_set: true
-  when:
-      - rhel9cis_flush_ipv6_route
-      - not system_is_container
 
 - name: Systemd restart tmp.mount
   ansible.builtin.systemd:

site.yml

@@ -1,6 +1,6 @@
 ---
 
-- name: Apply RHEL9 CIS hardening
+- name: Apply ansible-lockdown hardening
   hosts: all
   become: true
   roles:

tasks/auditd.yml

@@ -20,13 +20,13 @@
     - Restart auditd
 
 - name: POST | AUDITD | Add Warning count for changes to template file | Warn Count  # noqa no-handler
+  when:
+    - rhel9cis_auditd_template_updated.changed
+    - rhel9cis_auditd_file.stat.exists
   ansible.builtin.import_tasks:
     file: warning_facts.yml
   vars:
     warn_control_id: 'Auditd template updated, see diff output for details'
-  when:
-      - rhel9cis_auditd_template_updated.changed
-      - rhel9cis_auditd_file.stat.exists
 
 - name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
   ansible.builtin.stat:
@@ -34,6 +34,9 @@
   register: rhel9cis_auditd_exception_file
 
 - name: POST | Set up auditd user logging exceptions | setup file
+  when:
+    - rhel9cis_allow_auditd_uid_user_exclusions
+    - rhel9cis_auditd_uid_exclude | length > 0
   ansible.builtin.template:
     src: audit/98_auditd_exception.rules.j2
     dest: /etc/audit/rules.d/98_auditd_exceptions.rules
@@ -42,6 +45,3 @@
     mode: '0640'
   diff: "{{ rhel9cis_auditd_exception_file.stat.exists }}"
   notify: Restart auditd
-  when:
-      - rhel9cis_allow_auditd_uid_user_exclusions
-      - rhel9cis_auditd_uid_exclude | length > 0