sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

renamed variables

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-09-05 17:36:07 +01:00
parent c58c4eb4e8
commit 14d038e8eb
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
14 changed files with 113 additions and 113 deletions
Download patch file Download diff file Expand all files Collapse all files

22
tasks/section_6/cis_6.3.1.x.yml
View file

@ -42,13 +42,13 @@
changed_when: false
failed_when: false
check_mode: false
register: rhel9cis_6_3_1_2_grubby_curr_value_audit_linux
register: discovered_grubby_curr_value_audit_linux
- name: "6.3.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby update, if needed"
when:
- rhel9cis_6_3_1_2_grubby_curr_value_audit_linux.stdout == '' or
'0' in rhel9cis_6_3_1_2_grubby_curr_value_audit_linux.stdout or
'off' in rhel9cis_6_3_1_2_grubby_curr_value_audit_linux.stdout|lower
- discovered_grubby_curr_value_audit_linux.stdout == '' or
'0' in discovered_grubby_curr_value_audit_linux.stdout or
'off' in discovered_grubby_curr_value_audit_linux.stdout|lower
ansible.builtin.shell: grubby --update-kernel=ALL --args="audit=1"
- name: "6.3.1.3 | PATCH | Ensure audit_backlog_limit is sufficient"
@ -71,25 +71,25 @@
changed_when: false
failed_when: false
check_mode: false
register: rhel9cis_6_3_1_3_grubby_curr_value_backlog_linux
register: discovered_grubby_curr_value_backlog_linux
- name: "6.3.1.3 | AUDIT | Check to see if limits are set"
when:
- rhel9cis_6_3_1_3_grubby_curr_value_backlog_linux is not defined or
rhel9cis_6_3_1_3_grubby_curr_value_backlog_linux.stdout_lines == []
- discovered_grubby_curr_value_backlog_linux is not defined or
discovered_grubby_curr_value_backlog_linux.stdout_lines == []
ansible.builtin.set_fact:
rhel9cis_6_3_1_3_reset_backlog_limits: true
discovered_reset_backlog_limits: true
- name: "6.3.1.3 | AUDIT | Check to see if any limits are too low"
when:
- (item | int < rhel9cis_audit_back_log_limit)
ansible.builtin.set_fact:
rhel9cis_6_3_1_3_reset_backlog_limits: true
loop: "{{ rhel9cis_6_3_1_3_grubby_curr_value_backlog_linux.stdout_lines }}"
discovered_reset_backlog_limits: true
loop: "{{ discovered_grubby_curr_value_backlog_linux.stdout_lines }}"
- name: "6.3.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby update applied"
when:
- rhel9cis_6_3_1_3_reset_backlog_limits is defined
- discovered_reset_backlog_limits is defined
ansible.builtin.shell:
cmd: 'grubby --update-kernel=ALL --args="audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}"'