improvements

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_7/cis_7.1.x.yml

@@ -192,6 +192,7 @@
     - name: "7.1.11 | PATCH | Ensure no world writable files exist | Adjust world-writable files if they exist (Configurable)"
       when:
         - rhel_09_7_1_11_perms_results.stdout_lines is defined
+        - rhel_09_7_1_11_perms_results.stdout_lines | length > 0
         - rhel9cis_no_world_write_adjust
       ansible.builtin.file:
         path: '{{ item }}'
@@ -200,7 +201,10 @@
       loop: "{{ rhel_09_7_1_11_perms_results.stdout_lines }}"
 
     - name: "7.1.11 | PATCH | Ensure no world writable files exist | Adjust world-writable directories add sticky bit"
-      ansible.builtin.shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -0002 2>/dev/null | xargs chmod a+t
+      ansible.builtin.shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type d -perm -o+w ! -perm -1002 2>/dev/null | xargs chmod a+t
+      failed_when: rhel9cis_set_stickybit.rc not in [ 0, 123 ]
+      changed_when: rhel9cis_set_stickybit.rc == 0
+      register: rhel9cis_set_stickybit
 
 - name: "7.1.12 | PATCH | Ensure no files or directories without an owner and a group exist"
   when:
@@ -250,7 +254,7 @@
         owner: "{{ rhel9cis_unowned_owner }}"
         group: "{{ rhel9cis_unowned_group }}"
       with_items:
-        - "{{ udiscovered_unowned_files_flatten }}"
+        - "{{ discovered_unowned_files_flatten }}"
 
     - name: "7.1.12 | AUDIT | Ensure no files or directories without an owner and a group exist | Warn Count"
       when:

tasks/section_7/cis_7.2.x.yml

@@ -84,7 +84,7 @@
     - name: "7.2.3 | AUDIT | Ensure all groups in /etc/passwd exist in /etc/group | Print warning about users with invalid GIDs missing GID entries in /etc/group"
       when: discovered_passwd_gid_check.stdout | length > 0
       ansible.builtin.debug:
-        msg: "Warning!! The following users have non-existent GIDs (Groups): {{ discovered_passwd_gid_check.stdout_lines | join (', ') }}"
+        msg: "Warning!! The following users have non-existent GIDs (Groups): {{ discovered_passwd_gid_check.stdout_lines | join(', ') }}"
 
     - name: "7.2.3 | WARNING | Ensure all groups in /etc/passwd exist in /etc/group | warn_count"
       when: discovered_passwd_gid_check.stdout | length > 0
@@ -243,7 +243,7 @@
         state: directory
         owner: "{{ item.id }}"
         group: "{{ item.gid }}"
-      loop: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '<=', max_int_uid | int ) | list }}"
+      loop: "{{ rhel9cis_passwd | selectattr('uid', '>=', prelim_min_int_uid | int) | selectattr('uid', '<=', max_int_uid | int) | list }}"
       loop_control:
         label: "{{ item.id }}"
 
@@ -316,31 +316,3 @@
         path: '{{ item }}'
         mode: 'go-w'
       with_items: "{{ discovered_homedir_dot_files.stdout_lines }}"
-
-- name: "7.2.4 | PATCH | Ensure shadow group is empty"
-  when:
-    - rhel9cis_rule_7_2_4
-  tags:
-    - level1-server
-    - level1-workstation
-    - patch
-    - rule_6.2.4
-    - user
-  vars:
-    warn_control_id: '7.2.4'
-  block:
-    - name: "7.2.4 | AUDIT | Ensure shadow group is empty | check users in group"
-      ansible.builtin.getent:
-        database: group
-        split: ':'
-        key: shadow
-
-    - name: "7.2.4 | AUDIT | Ensure shadow group is empty | check users in group"
-      ansible.builtin.debug:
-        msg: "Warning!! - You have users in the shadow group"
-      when: ansible_facts.getent_group.shadow[2] | length > 0
-
-    - name: "7.2.4 | AUDIT | Ensure shadow group is empty | check users in group"
-      ansible.builtin.import_tasks:
-        file: warning_facts.yml
-      when: ansible_facts.getent_group.shadow[2] | length > 0