section_1 updates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_1/cis_1.8.x.yml

@@ -0,0 +1,111 @@
+---
+
+- name: "1.8.1 | PATCH | Ensure GNOME Display Manager is removed"
+  package:
+      name: gdm
+      state: absent
+  when:
+      - rhel9cis_rule_1_8_1
+      - "'gdm' in ansible_facts.packages"
+  tags:
+      - level2-server
+      - automated
+      - patch
+      - gui
+      - gdm
+      - rule_1.8.1
+
+- name: "1.8.2 | PATCH | Ensure GDM login banner is configured"
+  lineinfile:
+      dest: "{{ item.file }}"
+      regexp: "{{ item.regexp }}"
+      line: "{{ item.line }}"
+      state: present
+      create: yes
+      owner: root
+      group: root
+      mode: 0644
+  notify: reload dconf
+  with_items:
+      - { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
+      - { file: '/etc/dconf/profile/gdm', regexp: 'system-db', line: 'system-db:gdm' }
+      - { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults' }
+      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
+      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-enable', line: 'banner-message-enable=true' }
+      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-text', line: "banner-message-text='{{ rhel9cis_warning_banner }}' " }
+  when:
+      - rhel9cis_rule_1_8_2
+      - rhel9cis_gui
+  tags:
+      - level1-server
+      - level1-workstation
+      - automated
+      - patch
+      - gui
+      - gdm
+      - rule_1.8.2
+
+- name: "1.8.3 | PATCH | Ensure last logged in user display is disabled"
+  lineinfile:
+      path: "{{ item.file }}"
+      regexp: "{{ item.regexp }}"
+      line: "{{ item.line }}"
+      create: yes
+      owner: root
+      group: root
+      mode: 0644
+  notify: reload dconf
+  with_items:
+      - { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
+      - { file: '/etc/dconf/profile/gdm', regexp: 'system-db', line: 'system-db:gdm' }
+      - { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults'}
+      - { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
+      - { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: 'disable-user-list=', line: 'disable-user-list=true' }
+  when:
+      - rhel9cis_rule_1_8_3
+      - rhel9cis_gui
+  tags:
+      - level1-server
+      - level1-workstation
+      - automated
+      - patch
+      - gui
+      - rule_1.8.3
+
+- name: "1.8.4 | PATCH | Ensure XDMCP is not enabled"
+  lineinfile:
+      path: /etc/gdm/custom.conf
+      regexp: 'Enable=true'
+      state: absent
+  when:
+      - rhel9cis_rule_1_8_4
+      - rhel9cis_gui
+  tags:
+      - level1-server
+      - level1-workstation
+      - automated
+      - patch
+      - gui
+      - rule_1.8.4
+
+- name: "1.8.5 | PATCH | Ensure automatic mounting of removable media is disabled"
+  lineinfile:
+      path: /etc/dconf/db/local.d/00-media-automount
+      regex: "{{ item.regex }}"
+      line: "{{ item.line }}"
+      create: yes
+  notify: reload dconf
+  with_items:
+      - { regex: '\[org\/gnome\/desktop\/media-handling\]', line: '[org/gnome/desktop/media-handling]' }
+      - { regex: 'automount=', line: 'automount=false' }
+      - { regex: 'automount-open=', line: 'automount-open=false'}
+  when:
+      - rhel9cis_rule_1_8_5
+      - rhel9cis_gui
+  tags:
+      - level1-server
+      - level2-workstation
+      - automated
+      - patch
+      - gui
+      - rule_1.8.5