ansible-lockdown/RHEL9-CIS
3
0
Fork 1
mirror of https://github.com/ansible-lockdown/RHEL9-CIS.git synced 2025-12-24 22:23:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Additional; step to show diff of template

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2023-01-26 15:00:10 +00:00
parent 9cf1f08eec
commit b5a5d3e951
No known key found for this signature in database
GPG key ID: 1DE02A772D0908F9
1 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
tasks/auditd.yml
View file

@ -1,25 +1,36 @@
---
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
ansible.builtin.stat:
path: /etc/audit/rules.d/99_auditd.rules
register: auditd_file
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | setup file
ansible.builtin.template:
src: audit/99_auditd.rules.j2
dest: /etc/audit/rules.d/99_auditd.rules
owner: root
group: root
mode: 0640
diff: "{{ auditd_file.stat.exists }}" # Only run diff if not a new file
register: audit_rules_updated
notify:
- Auditd immutable check
- Audit immutable fact
- Restart auditd
- name: POST | Set up auditd user logging exceptions
- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
ansible.builtin.stat:
path: /etc/audit/rules.d/98_auditd_exceptions.rules
register: auditd_exception_file
- name: POST | Set up auditd user logging exceptions | setup file
ansible.builtin.template:
src: audit/98_auditd_exception.rules.j2
dest: /etc/audit/rules.d/98_auditd_exceptions.rules
owner: root
group: root
mode: 0600
mode: 0640
diff: "{{ auditd_exception_file.stat.exists }}"
notify: Restart auditd
when:
- allow_auditd_uid_user_exclusions