forked from ansible-lockdown/RHEL9-CIS
v1.0.0 updates
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
4e004e7d88
commit
2634fabd41
18 changed files with 288 additions and 329 deletions
|
|
@ -4,7 +4,7 @@
|
|||
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp"
|
||||
block:
|
||||
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Absent"
|
||||
debug:
|
||||
ansible.builtin.debug:
|
||||
msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
|
||||
register: var_tmp_mount_absent
|
||||
changed_when: var_tmp_mount_absent.skipped is undefined
|
||||
|
|
@ -12,14 +12,14 @@
|
|||
- required_mount not in mount_names
|
||||
|
||||
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Warn Count"
|
||||
set_fact:
|
||||
ansible.builtin.set_fact:
|
||||
control_number: "{{ control_number }} + [ 'rule_1.1.4.1' ]"
|
||||
warn_count: "{{ warn_count | int + 1 }}"
|
||||
when:
|
||||
- required_mount not in mount_names
|
||||
|
||||
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Present"
|
||||
debug:
|
||||
ansible.builtin.debug:
|
||||
msg: "Congratulations: {{ required_mount }} exists."
|
||||
register: var_tmp_mount_present
|
||||
when:
|
||||
|
|
@ -31,7 +31,6 @@
|
|||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
- automated
|
||||
- audit
|
||||
- mounts
|
||||
- rule_1.1.4.1
|
||||
|
|
@ -41,12 +40,12 @@
|
|||
"1.1.4.2 | PATCH | Ensure noexec option set on /var/tmp partition"
|
||||
"1.1.4.3 | PATCH | Ensure nosuid option set on /var/tmp partition"
|
||||
"1.1.4.4 | PATCH | Ensure nodev option set on /var/tmp partition"
|
||||
mount:
|
||||
ansible.builtin.mount:
|
||||
name: /var/tmp
|
||||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_4 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_4_2 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_4_3 %}nodev{% endif %}
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
loop_control:
|
||||
|
|
@ -62,7 +61,6 @@
|
|||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
- automated
|
||||
- patch
|
||||
- mounts
|
||||
- skip_ansible_lint
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue