updated yamllint, company naming, linting and spacing

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_3/cis_3.1.x.yml

@@ -40,7 +40,7 @@
   block:
     - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Check for network-manager tool"
       when: "'network-manager' in ansible_facts.packages"
-      ansible.builtin.shell: nmcli radio wifi
+      ansible.builtin.command: nmcli radio wifi
       changed_when: false
       failed_when: false
       check_mode: false
@@ -50,7 +50,7 @@
       when:
         - "'network-manager' in ansible_facts.packages"
         - "'enabled' in discovered_wifi_status.stdout"
-      ansible.builtin.shell: nmcli radio all off
+      ansible.builtin.command: nmcli radio all off
       changed_when: discovered_nmcli_radio_off.rc == 0
       register: discovered_nmcli_radio_off
 
@@ -65,8 +65,7 @@
         file: warning_facts.yml
 
 - name: "3.1.3 | PATCH | Ensure bluetooth services are not in use"
-  when:
-    - rhel9cis_rule_3_1_3
+  when: rhel9cis_rule_3_1_3
   tags:
     - level1-server
     - level2-workstation

tasks/section_3/cis_3.2.x.yml

@@ -1,8 +1,7 @@
 ---
 
 - name: "3.2.1 | PATCH | Ensure dccp kernel module is not available"
-  when:
-    - rhel9cis_rule_3_2_1
+  when: rhel9cis_rule_3_2_1
   tags:
     - level2-server
     - level2-workstation
@@ -18,6 +17,7 @@
         regexp: '^(#)?install dccp(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'go-wx'
       loop:
         - install dccp /bin/true
         - blacklist dccp
@@ -28,11 +28,10 @@
         regexp: "^(#)?blacklist cramfs(\\s|$)"
         line: "blacklist cramfs"
         create: true
-        mode: '0600'
+        mode: 'go-wx'
 
 - name: "3.2.2 | PATCH | Ensure tipc kernel module is not available"
-  when:
-    - rhel9cis_rule_3_2_2
+  when: rhel9cis_rule_3_2_2
   tags:
     - level2-server
     - level2-workstation
@@ -48,6 +47,7 @@
         regexp: '^(#)?install tipc(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'go-wx'
       loop:
         - install tipc /bin/true
         - blacklist tipc
@@ -58,11 +58,10 @@
         regexp: "^(#)?blacklist tipc(\\s|$)"
         line: "blacklist tipc"
         create: true
-        mode: '0600'
+        mode: 'go-wx'
 
 - name: "3.2.3 | PATCH | Ensure rds kernel module is not available"
-  when:
-    - rhel9cis_rule_3_2_3
+  when: rhel9cis_rule_3_2_3
   tags:
     - level2-server
     - level2-workstation
@@ -78,6 +77,7 @@
         regexp: '^(#)?install rds(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'go-wx'
       loop:
         - install rds /bin/true
         - blacklist rds
@@ -88,11 +88,10 @@
         regexp: "^(#)?blacklist rds(\\s|$)"
         line: "blacklist rds"
         create: true
-        mode: '0600'
+        mode: 'go-wx'
 
 - name: "3.2.4 | PATCH | Ensure sctp kernel module is not available"
-  when:
-    - rhel9cis_rule_3_2_4
+  when: rhel9cis_rule_3_2_4
   tags:
     - level2-server
     - level2-workstation
@@ -108,6 +107,7 @@
         regexp: '^(#)?install sctp(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'go-wx'
       loop:
         - install sctp /bin/true
         - blacklist sctp
@@ -118,4 +118,4 @@
         regexp: "^(#)?blacklist sctp(\\s|$)"
         line: "blacklist sctp"
         create: true
-        mode: '0600'
+        mode: 'go-wx'

tasks/section_3/cis_3.3.x.yml

@@ -61,8 +61,7 @@
         msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
 
 - name: "3.3.3 | PATCH | Ensure bogus ICMP responses are ignored"
-  when:
-    - rhel9cis_rule_3_3_3
+  when: rhel9cis_rule_3_3_3
   tags:
     - level1-server
     - level1-workstation
@@ -85,8 +84,7 @@
         msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
 
 - name: "3.3.4 | PATCH | Ensure broadcast ICMP requests are ignored"
-  when:
-    - rhel9cis_rule_3_3_4
+  when: rhel9cis_rule_3_3_4
   tags:
     - level1-server
     - level1-workstation
@@ -109,8 +107,7 @@
         msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
 
 - name: "3.3.5 | PATCH | Ensure ICMP redirects are not accepted"
-  when:
-    - rhel9cis_rule_3_3_5
+  when: rhel9cis_rule_3_3_5
   tags:
     - level1-server
     - level1-workstation
@@ -144,8 +141,7 @@
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
 
 - name: "3.3.6 | PATCH | Ensure secure ICMP redirects are not accepted"
-  when:
-    - rhel9cis_rule_3_3_6
+  when: rhel9cis_rule_3_3_6
   tags:
     - level1-server
     - level1-workstation
@@ -179,8 +175,7 @@
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
 
 - name: "3.3.7 | PATCH | Ensure Reverse Path Filtering is enabled"
-  when:
-    - rhel9cis_rule_3_3_7
+  when: rhel9cis_rule_3_3_7
   tags:
     - level1-server
     - level1-workstation
@@ -203,8 +198,7 @@
         msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
 
 - name: "3.3.8 | PATCH | Ensure source routed packets are not accepted"
-  when:
-    - rhel9cis_rule_3_3_8
+  when: rhel9cis_rule_3_3_8
   tags:
     - level1-server
     - level1-workstation
@@ -237,8 +231,7 @@
             msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
 
 - name: "3.3.9 | PATCH | Ensure suspicious packets are logged"
-  when:
-    - rhel9cis_rule_3_3_9
+  when: rhel9cis_rule_3_3_9
   tags:
     - level1-server
     - level1-workstation
@@ -257,8 +250,7 @@
         msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
 
 - name: "3.3.10 | PATCH | Ensure TCP SYN Cookies is enabled"
-  when:
-    - rhel9cis_rule_3_3_10
+  when: rhel9cis_rule_3_3_10
   tags:
     - level1-server
     - level1-workstation