RHEL9-CIS/tasks/section_4/cis_4.2.3.yml

---

- name: "4.2.3 | PATCH | Ensure permissions on all logfiles are configured"
  block:
      - name: "4.2.3 | AUDIT | Ensure permissions on all logfiles are configured | find files"
        ansible.builtin.find:
            paths: "/var/log"
            file_type: file
            recurse: true
            hidden: true
        register: logfiles

      - name: "4.2.3 | PATCH | Ensure permissions on all logfiles are configured | change permissions"
        ansible.builtin.file:
            path: "{{ item.path }}"
            mode: "{{ '0600' if item.mode == '0600' else '0640' }}"
        failed_when: rhel9cis_4_2_3_file_list.state not in '[ file, absent ]'
        register: rhel9cis_4_2_3_file_list
        loop: "{{ logfiles.files }}"
        loop_control:
            label: "{{ item.path }}"
        when:
            - item.path != "/var/log/btmp"
            - item.path != "/var/log/utmp"
            - item.path != "/var/log/wtmp"
  when:
      - rhel9cis_rule_4_2_3
  tags:
      - level1-server
      - level1-workstation
      - patch
      - logfiles
      - rule_4.2.3