sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

lint updates

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2022-09-16 11:10:31 +01:00
parent 1e22c13794
commit 33340c7487
No known key found for this signature in database
GPG key ID: F734FDFC154B83FB
13 changed files with 27 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

6
tasks/section_1/cis_1.1.1.x.yml
View file

@ -7,7 +7,7 @@
path: /etc/modprobe.d/CIS.conf path: /etc/modprobe.d/CIS.conf
regexp: "^(#)?install cramfs(\\s|$)" regexp: "^(#)?install cramfs(\\s|$)"
line: "install cramfs /bin/true" line: "install cramfs /bin/true"
create: yes create: true
mode: 0600 mode: 0600
- name: "1.1.1.1 | PATCH | Ensure mounting of cramfs filesystems is disabled | Disable cramfs" - name: "1.1.1.1 | PATCH | Ensure mounting of cramfs filesystems is disabled | Disable cramfs"
@ -32,7 +32,7 @@
path: /etc/modprobe.d/CIS.conf path: /etc/modprobe.d/CIS.conf
regexp: "^(#)?install squashfs(\\s|$)" regexp: "^(#)?install squashfs(\\s|$)"
line: "install squashfs /bin/true" line: "install squashfs /bin/true"
create: yes create: true
mode: 0600 mode: 0600
- name: "1.1.1.2 | PATCH | Ensure mounting of squashfs filesystems is disabled | Disable squashfs" - name: "1.1.1.2 | PATCH | Ensure mounting of squashfs filesystems is disabled | Disable squashfs"
@ -57,7 +57,7 @@
path: /etc/modprobe.d/CIS.conf path: /etc/modprobe.d/CIS.conf
regexp: "^(#)?install udf(\\s|$)" regexp: "^(#)?install udf(\\s|$)"
line: "install udf /bin/true" line: "install udf /bin/true"
create: yes create: true
mode: 0600 mode: 0600
- name: "1.1.1.3 | PATCH | Ensure mounting of udf filesystems is disable | Disable udf" - name: "1.1.1.3 | PATCH | Ensure mounting of udf filesystems is disable | Disable udf"

2
tasks/section_1/cis_1.1.2.x.yml
View file

@ -11,7 +11,7 @@
- name: "1.1.2.1 | PATCH | Ensure /tmp is a separate partition | Warn Count" - name: "1.1.2.1 | PATCH | Ensure /tmp is a separate partition | Warn Count"
set_fact: set_fact:
control_number: "{{ control_number }} + [ 'rule_1.1.2.1' ]" control_number: "{{ control_number }} + [ 'rule_1.1.2.1' ]"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: when:
- required_mount not in mount_names - required_mount not in mount_names

2
tasks/section_1/cis_1.1.3.x.yml
View file

@ -13,7 +13,7 @@
- name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | Warn Count" - name: "1.1.3.1 | AUDIT | Ensure separate partition exists for /var | Warn Count"
set_fact: set_fact:
control_number: "{{ control_number }} + [ 'rule_1.1.3.1' ]" control_number: "{{ control_number }} + [ 'rule_1.1.3.1' ]"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: when:
- required_mount not in mount_names - required_mount not in mount_names

2
tasks/section_1/cis_1.1.4.x.yml
View file

@ -14,7 +14,7 @@
- name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Warn Count" - name: "1.1.4.1 | AUDIT | Ensure separate partition exists for /var/tmp | Warn Count"
set_fact: set_fact:
control_number: "{{ control_number }} + [ 'rule_1.1.4.1' ]" control_number: "{{ control_number }} + [ 'rule_1.1.4.1' ]"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: when:
- required_mount not in mount_names - required_mount not in mount_names

2
tasks/section_1/cis_1.1.5.x.yml
View file

@ -13,7 +13,7 @@
- name: "1.1.5.1 | AUDIT | Ensure separate partition exists for /var/log | Warn Count" - name: "1.1.5.1 | AUDIT | Ensure separate partition exists for /var/log | Warn Count"
set_fact: set_fact:
control_number: "{{ control_number }} + [ 'rule_1.1.5.1' ]" control_number: "{{ control_number }} + [ 'rule_1.1.5.1' ]"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: when:
- required_mount not in mount_names - required_mount not in mount_names

2
tasks/section_1/cis_1.1.6.x.yml
View file

@ -13,7 +13,7 @@
- name: "1.1.6.1 | AUDIT | Ensure separate partition exists for /var/log/audit | Warn Count" - name: "1.1.6.1 | AUDIT | Ensure separate partition exists for /var/log/audit | Warn Count"
set_fact: set_fact:
control_number: "{{ control_number }} + [ 'rule_1.1.6.1' ]" control_number: "{{ control_number }} + [ 'rule_1.1.6.1' ]"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: when:
- required_mount not in mount_names - required_mount not in mount_names

2
tasks/section_1/cis_1.1.7.x.yml
View file

@ -13,7 +13,7 @@
- name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Warn Count" - name: "1.1.7.1 | AUDIT | Ensure separate partition exists for /home | Warn Count"
set_fact: set_fact:
control_number: "{{ control_number }} + [ 'rule_1.1.7.1' ]" control_number: "{{ control_number }} + [ 'rule_1.1.7.1' ]"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: when:
- required_mount not in mount_names - required_mount not in mount_names

2
tasks/section_1/cis_1.1.8.x.yml
View file

@ -13,7 +13,7 @@
shell: mount -l | grep -E '\s/dev/shm\s' shell: mount -l | grep -E '\s/dev/shm\s'
changed_when: false changed_when: false
failed_when: false failed_when: false
check_mode: no check_mode: false
register: rhel9cis_1_1_8_x_dev_shm_status register: rhel9cis_1_1_8_x_dev_shm_status
- name: | - name: |

4
tasks/section_1/cis_1.1.x.yml
View file

@ -3,7 +3,7 @@
- name: "1.1.9 | PATCH | Disable Automounting" - name: "1.1.9 | PATCH | Disable Automounting"
service: service:
name: autofs name: autofs
enabled: no enabled: false
when: when:
- not rhel9cis_allow_autofs - not rhel9cis_allow_autofs
- "'autofs' in ansible_facts.packages" - "'autofs' in ansible_facts.packages"
@ -24,7 +24,7 @@
path: /etc/modprobe.d/CIS.conf path: /etc/modprobe.d/CIS.conf
regexp: "^(#)?install usb-storage(\\s|$)" regexp: "^(#)?install usb-storage(\\s|$)"
line: "install usb-storage /bin/true" line: "install usb-storage /bin/true"
create: yes create: true
owner: root owner: root
group: root group: root
mode: 0600 mode: 0600

6
tasks/section_1/cis_1.2.x.yml
View file

@ -27,7 +27,7 @@
failed_when: false failed_when: false
register: os_installed_pub_keys register: os_installed_pub_keys
#- debug: # - debug:
# msg: "{{ os_installed_pub_keys }}" # msg: "{{ os_installed_pub_keys }}"
- name: "1.2.2 | AUDIT | Ensure GPG keys are configured | Query found keys" - name: "1.2.2 | AUDIT | Ensure GPG keys are configured | Query found keys"
@ -96,7 +96,7 @@
changed_when: false changed_when: false
failed_when: false failed_when: false
register: dnf_configured register: dnf_configured
check_mode: no check_mode: false
args: args:
warn: false warn: false
@ -109,7 +109,7 @@
- name: "1.2.4 | AUDIT | Ensure package manager repositories are configured | Warn Count" - name: "1.2.4 | AUDIT | Ensure package manager repositories are configured | Warn Count"
set_fact: set_fact:
control_number: "{{ control_number }} + ['rule_1.2.4']" control_number: "{{ control_number }} + ['rule_1.2.4']"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: when:
- rhel9cis_rule_1_2_4 - rhel9cis_rule_1_2_4
tags: tags:

2
tasks/section_1/cis_1.4.x.yml
View file

@ -58,7 +58,7 @@
path: /etc/systemd/system/rescue.service.d/00-require-auth.conf path: /etc/systemd/system/rescue.service.d/00-require-auth.conf
regexp: '^ExecStart=' regexp: '^ExecStart='
line: "ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue" line: "ExecStart=-/usr/lib/systemd/systemd-sulogin-shell rescue"
create: yes create: true
owner: root owner: root
group: root group: root
mode: 0644 mode: 0644

2
tasks/section_1/cis_1.6.1.x.yml
View file

@ -84,7 +84,7 @@
- name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | warning count" - name: "1.6.1.5 | AUDIT | Ensure no unconfined services exist | warning count"
set_fact: set_fact:
control_number: "{{ control_number }} + [ 'rule_1.6.1.5' ]" control_number: "{{ control_number }} + [ 'rule_1.6.1.5' ]"
warn_count: "{{ warn_count|int + 1 }}" warn_count: "{{ warn_count | int + 1 }}"
when: rhelcis_1_6_1_5_unconf_services.stdout | length > 0 when: rhelcis_1_6_1_5_unconf_services.stdout | length > 0
when: when:
- rhel9cis_rule_1_6_1_5 - rhel9cis_rule_1_6_1_5

9
tasks/section_1/cis_1.8.x.yml
View file

@ -21,7 +21,7 @@
regexp: "{{ item.regexp }}" regexp: "{{ item.regexp }}"
line: "{{ item.line }}" line: "{{ item.line }}"
state: present state: present
create: yes create: true
owner: root owner: root
group: root group: root
mode: 0644 mode: 0644
@ -50,7 +50,7 @@
path: "{{ item.file }}" path: "{{ item.file }}"
regexp: "{{ item.regexp }}" regexp: "{{ item.regexp }}"
line: "{{ item.line }}" line: "{{ item.line }}"
create: yes create: true
owner: root owner: root
group: root group: root
mode: 0644 mode: 0644
@ -93,7 +93,10 @@
path: /etc/dconf/db/local.d/00-media-automount path: /etc/dconf/db/local.d/00-media-automount
regexp: "{{ item.regex }}" regexp: "{{ item.regex }}"
line: "{{ item.line }}" line: "{{ item.line }}"
create: yes create: true
owner: root
group: root
mode: 0644
notify: reload dconf notify: reload dconf
with_items: with_items:
- { regex: '\[org\/gnome\/desktop\/media-handling\]', line: '[org/gnome/desktop/media-handling]' } - { regex: '\[org\/gnome\/desktop\/media-handling\]', line: '[org/gnome/desktop/media-handling]' }