lint updates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_2/cis_2.1.x.yml

@@ -29,7 +29,7 @@
             path: /etc/sysconfig/chronyd
             regexp: "^(#)?OPTIONS"
             line: "OPTIONS=\"-u chrony\""
-            create: yes
+            create: true
             mode: 0644
   when:
       - rhel9cis_rule_2_1_2

tasks/section_2/cis_2.4.yml

@@ -6,7 +6,7 @@
         shell: systemctl list-units --type=service
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_2_4_services
 
       - name: "2.4 | AUDIT | Ensure nonessential services are removed or masked | Display list of services"

tasks/section_3/cis_3.1.x.yml

@@ -68,9 +68,9 @@
         command: rpm -q NetworkManager
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         args:
-            warn: no
+            warn: false
         register: rhel_08_nmcli_available
 
       - name: "3.1.4 | AUDIT | Ensure wireless interfaces are disabled | Check if wifi is enabled"

tasks/section_3/cis_3.2.x.yml

@@ -6,10 +6,13 @@
         set_fact:
             sysctl_update: true
             flush_ipv4_route: true
+
       - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
         debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-      - block:
+
+      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | IPv6"
+        block:
             - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding | Set Fact"
               set_fact:
                   flush_ipv6_route: true

tasks/section_3/cis_3.3.x.yml

@@ -10,7 +10,8 @@
         debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
 
-      - block:
+      - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv6"
+        block:
             - name: "3.3.1 | PATCH | Ensure source routed packets are not accepted | IPv6 | Set Fact"
               set_fact:
                   flush_ipv6_route: true
@@ -39,7 +40,8 @@
         debug:
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
 
-      - block:
+      - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv6"
+        block:
             - name: "3.3.2 | PATCH | Ensure ICMP redirects are not accepted | IPv6 | Set Fact"
               set_fact:
                   flush_ipv6_route: true

tasks/section_3/cis_3.4.1.x.yml

@@ -49,7 +49,7 @@
         systemd:
             name: nftables
             state: stopped
-            masked: yes
+            masked: true
         when:
             - rhel9cis_firewalld_nftables_state == "masked"
 
@@ -73,7 +73,7 @@
   systemd:
       name: firewalld
       state: started
-      enabled: yes
+      enabled: true
   when:
       - rhel9cis_rule_3_4_1_4
   tags:
@@ -112,7 +112,7 @@
         shell: "nmcli -t connection show | awk -F: '{ if($4){print $4} }' | while read INT; do firewall-cmd --get-active-zones | grep -B1 $INT; done"
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_3_4_1_6_interfacepolicy
 
       - name: "3.4.1.6 | AUDIT | Ensure network interfaces are assigned to appropriate zone | Get list of interfaces and polocies | Show the interface to policy"
@@ -135,7 +135,7 @@
         shell: "firewall-cmd --get-active-zones | awk '!/:/ {print $1}' | while read ZN; do firewall-cmd --list-all --zone=$ZN; done"
         changed_when: false
         failed_when: false
-        check_mode: no
+        check_mode: false
         register: rhel9cis_3_4_1_7_servicesport
 
       - name: "3.4.1.7 | AUDIT | Ensure firewalld drops unnecessary services and ports | Show services and ports"

tasks/section_3/cis_3.4.2.x.yml

@@ -112,7 +112,7 @@
 
       - name: "3.4.2.5 | PATCH | Ensure a table exists | Create table if needed"
         command: nft create table inet "{{ rhel9cis_nft_tables_tablename }}"
-        failed_when: no
+        failed_when: false
         when: rhel9cis_nft_tables_autonewtable
   when:
       - rhel9cis_firewall == "nftables"
@@ -159,8 +159,8 @@
       - name: "3.4.2.6 | PATCH | Ensure nftables base chains exist | Create chains if needed"
         shell: "{{ item }}"
         args:
-            warn: no
+            warn: false
-        failed_when: no
+        failed_when: false
         with_items:
             - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" input { type filter hook input priority 0 \; }
             - nft create chain inet "{{ rhel9cis_nft_tables_tablename }}" forward { type filter hook forward priority 0 \; }
@@ -322,7 +322,7 @@
 - name: "3.4.2.10 | PATCH | Ensure nftables service is enabled"
   service:
       name: nftables
-      enabled: yes
+      enabled: true
   when:
       - rhel9cis_firewall == "nftables"
       - rhel9cis_rule_3_4_2_10