RHEL9-CIS/tasks/pre_remediation_audit.yml

---

- name: Pre Audit | Setup the audit
  include_tasks: LE_audit_setup.yml
  when:
  - setup_audit
  tags:
  - setup_audit

- name: "Pre Audit | Ensure {{ audit_conf_dir }} exists"
  file:
      path: "{{ audit_conf_dir }}"
      state: directory
      mode: '0755'

- name: Pre Audit | retrieve audit content files from git
  git:
      repo: "{{ audit_file_git }}"
      dest: "{{ audit_conf_dir }}"
      version: "{{ audit_git_version }}"
  when:
  - audit_content == 'git'

- name: Pre Audit | copy to audit content files to server
  copy:
      src: "{{ audit_local_copy }}"
      dest: "{{ audit_conf_dir }}"
      mode: 0644
  when:
  - audit_content == 'copy'

- name: Pre Audit | get audit content from url
  get_url:
      url: "{{ audit_files_url }}"
      dest: "{{ audit_conf_dir }}"
      owner: root
      group: root
      mode: 0755
  when:
  - audit_content == 'get_url'

- name: Pre Audit | Check Goss is available
  block:
  - name: Pre Audit | Check for goss file
    stat:
        path: "{{ audit_bin }}"
    register: goss_available

  - name: Pre Audit | Alert if goss not available
    assert:
        that: goss_available.stat.exists
        fail_msg: "Audit binary file {{ audit_bin }} does not exist"
        success_msg: "Audit binary file {{ audit_bin }} exists"
  when:
  - run_audit

- name: "Pre Audit | Check whether machine is UEFI-based"
  stat:
      path: /sys/firmware/efi
  register: rhel9_efi_boot
  tags:
  - goss_template

- name: Pre Audit | Copy ansible default vars values to test audit
  template:
      src: ansible_vars_goss.yml.j2
      dest: "{{ audit_vars_path }}"
      mode: 0600
  when:
  - run_audit
  tags:
  - goss_template

- name: "Pre Audit | Run pre_remediation {{ benchmark }} audit"
  shell: "{{ audit_conf_dir }}/run_audit.sh -v {{ audit_vars_path }} -o {{ pre_audit_outfile }} -g {{ group_names }}"
  environment: "{{ audit_run_script_environment | default({}) }}"
  changed_when: audit_run_pre_remediation.rc == 0
  register: audit_run_pre_remediation

- name: Pre Audit | Capture audit data if json format
  block:
  - name: "Pre Audit | capture data {{ pre_audit_outfile }}"
    shell: "cat {{ pre_audit_outfile }}"
    register: pre_audit
    changed_when: false

  - name: Pre Audit | Capture pre-audit result
    set_fact:
        pre_audit_summary: "{{ pre_audit.stdout | from_json | json_query(summary) }}"
    vars:
        summary: 'summary."summary-line"'
  when:
  - audit_format == "json"

- name: Pre Audit | Capture audit data if documentation format
  block:
  - name: "Pre Audit | capture data {{ pre_audit_outfile }}"
    shell: "tail -2 {{ pre_audit_outfile }}"
    register: pre_audit
    changed_when: false

  - name: Pre Audit | Capture pre-audit result
    set_fact:
        pre_audit_summary: "{{ pre_audit.stdout_lines }}"
  when:
  - audit_format == "documentation"