RHEL9-CIS/handlers/main.yml

---
# handlers file for RHEL9-CIS

- name: Reload sysctl
  ansible.builtin.shell: sysctl --system

- name: Sysctl flush ipv4 route table
  ansible.posix.sysctl:
      name: net.ipv4.route.flush
      value: '1'
      sysctl_set: true
  ignore_errors: true  # noqa ignore-errors
  when:
      - rhel9cis_flush_ipv4_route
      - not system_is_container

- name: Sysctl flush ipv6 route table
  ansible.posix.sysctl:
      name: net.ipv6.route.flush
      value: '1'
      sysctl_set: true
  when:
      - rhel9cis_flush_ipv6_route
      - not system_is_container

- name: Systemd restart tmp.mount
  ansible.builtin.systemd:
      name: tmp.mount
      daemon_reload: true
      enabled: true
      masked: false
      state: reloaded

- name: Remount tmp
  ansible.posix.mount:
      path: /tmp
      state: remounted

- name: Restart firewalld
  ansible.builtin.systemd:
      name: firewalld
      state: restarted

- name: Restart sshd
  ansible.builtin.systemd:
      name: sshd
      state: restarted

- name: Restart postfix
  ansible.builtin.systemd:
      name: postfix
      state: restarted

- name: Reload dconf
  ansible.builtin.shell: dconf update

- name: Grub2cfg
  ansible.builtin.shell: "grub2-mkconfig -o /boot/grub2/grub.cfg"
  ignore_errors: true  # noqa ignore-errors
  tags:
      - skip_ansible_lint

- name: Restart rsyslog
  ansible.builtin.systemd:
      name: rsyslog
      state: restarted

- name: Restart journald
  ansible.builtin.systemd:
      name: systemd-journald
      state: restarted

- name: Restart systemd_journal_upload
  ansible.builtin.systemd:
      name: systemd-journal-upload
      state: restarted

- name: Systemd daemon reload
  ansible.builtin.systemd:
      daemon-reload: true

## Auditd tasks note order for handlers to run

- name: Auditd immutable check
  ansible.builtin.shell: grep -c "^-e 2" /etc/audit/rules.d/99_auditd.rules
  changed_when: false
  register: auditd_immutable_check

- name: Audit immutable fact
  ansible.builtin.debug:
      msg: "Reboot required for auditd to apply new rules as immutable set"
  notify: Change_requires_reboot
  when:
      - auditd_immutable_check.stdout == '1'

- name: Restart auditd
  ansible.builtin.shell: service auditd restart
  tags:
      - skip_ansible_lint

- name: Change_requires_reboot
  ansible.builtin.set_fact:
      change_requires_reboot: true