cis_v1.0.0 alignment updated

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_1/cis_1.1.2.x.yml

@@ -6,7 +6,7 @@
         ansible.builtin.debug:
             msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
 
-      - name: "1.1.2.1 | PATCH | Ensure /tmp is a separate partition | warning"
+      - name: "1.1.2.1 | PATCH | Ensure /tmp is a separate partition | Present"
         ansible.builtin.import_tasks: warning_facts.yml
   vars:
       warn_control_id: '1.1.2.1'

tasks/section_1/cis_1.1.3.x.yml

@@ -6,7 +6,7 @@
         ansible.builtin.debug:
             msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
 
-      - name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | warning"
+      - name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | Present"
         ansible.builtin.import_tasks: warning_facts.yml
   vars:
       warn_control_id: '1.1.3.1'
@@ -37,9 +37,7 @@
       label: "{{ item.device }}"
   notify: Change_requires_reboot
   when:
-      - var_mount_present is defined
       - item.mount == "/var"
-      - rhel9cis_rule_1_1_3_1  # This is required so the check takes place
       - rhel9cis_rule_1_1_3_2 or
         rhel9cis_rule_1_1_3_3 
   tags:

tasks/section_1/cis_1.1.4.x.yml

@@ -7,7 +7,7 @@
         ansible.builtin.debug:
             msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
 
-      - name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Absent"
+      - name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Present"
         ansible.builtin.import_tasks: warning_facts.yml
   vars:
       warn_control_id: '1.1.4.1'
@@ -32,16 +32,14 @@
       src: "{{ item.device }}"
       fstype: "{{ item.fstype }}"
       state: present
-      opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nodev{% endif %}
+      opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_4_4 %}nodev{% endif %}
   with_items:
       - "{{ ansible_mounts }}"
   loop_control:
       label: "{{ item.device }}"
   notify: Change_requires_reboot
   when:
-      - var_tmp_mount_present is defined
       - item.mount == "/var/tmp"
-      - rhel9cis_rule_1_1_4_1  # This is required so the check takes place
       - rhel9cis_rule_1_1_4_2 or
         rhel9cis_rule_1_1_4_3 or
         rhel9cis_rule_1_1_4_4

tasks/section_1/cis_1.1.5.x.yml

@@ -39,9 +39,7 @@
       label: "{{ item.device }}"
   notify: Change_requires_reboot
   when:
-      - var_log_mount_present is defined
       - item.mount == "/var/log"
-      - rhel9cis_rule_1_1_5_1  # This is required so the check takes place
       - rhel9cis_rule_1_1_5_2 or
         rhel9cis_rule_1_1_5_3 or
         rhel9cis_rule_1_1_5_4

tasks/section_1/cis_1.1.6.x.yml

@@ -38,9 +38,7 @@
       label: "{{ item.device }}"
   notify: Change_requires_reboot
   when:
-      - var_log_audit_mount_present is defined
       - item.mount == "/var/log/audit"
-      - rhel9cis_rule_1_1_6_1  # This is required so the check takes place
       - rhel9cis_rule_1_1_6_2 or
         rhel9cis_rule_1_1_6_3 or
         rhel9cis_rule_1_1_6_4

tasks/section_1/cis_1.1.7.x.yml

@@ -1,5 +1,8 @@
 ---
 
+- ansible.builtin.debug:
+    msg: "{{ mount_names }}"
+
 - name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home"
   block:
       - name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Absent"
@@ -8,9 +11,9 @@
 
       - name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Present"
         ansible.builtin.import_tasks: warning_facts.yml
-        vars:
-            warn_control_id: '1.1.7.1'
+
   vars:
+      warn_control_id: '1.1.7.1'
       required_mount: '/home'
   when:
       - required_mount not in mount_names
@@ -38,7 +41,6 @@
       label: "{{ item.device }}"
   notify: Change_requires_reboot
   when:
-      - home_mount_present is defined
       - item.mount == "/home"
       - rhel9cis_rule_1_1_7_1
       - rhel9cis_rule_1_1_7_2 or

tasks/section_1/cis_1.1.x.yml

@@ -16,6 +16,14 @@
         ansible.builtin.modprobe:
             name: usb-storage
             state: absent
+
+      - name: "1.1.9 | PATCH | Disable USB Storage | blacklist"
+        lineinfile:
+            path: /etc/modprobe.d/blacklist.conf
+            regexp: "^(#)?blacklist usb-storage(\\s|$)"
+            line: "blacklist usb-storage"
+            create: true
+            mode: 0600
   when:
       - rhel9cis_rule_1_1_9
   tags: