From 3c33ce50568cf3c7d38981bee99a1942934e3187 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Wed, 25 Jan 2023 09:47:26 +0000 Subject: [PATCH] with_items to loop Signed-off-by: Mark Bolwell --- tasks/section_6/cis_6.1.x.yml | 18 +++++++++--------- tasks/section_6/cis_6.2.x.yml | 27 ++++++++++++--------------- 2 files changed, 21 insertions(+), 24 deletions(-) diff --git a/tasks/section_6/cis_6.1.x.yml b/tasks/section_6/cis_6.1.x.yml index 37b074d..a1c638d 100644 --- a/tasks/section_6/cis_6.1.x.yml +++ b/tasks/section_6/cis_6.1.x.yml @@ -133,7 +133,7 @@ path: '{{ item }}' mode: o-w state: touch - with_items: "{{ rhel_09_6_1_9_perms_results.stdout_lines }}" + loop: "{{ rhel_09_6_1_9_perms_results.stdout_lines }}" when: - rhel_09_6_1_9_perms_results.stdout_lines is defined - rhel9cis_no_world_write_adjust @@ -155,7 +155,7 @@ failed_when: false check_mode: false register: rhel_09_6_1_10_audit - with_items: "{{ ansible_mounts }}" + loop: "{{ ansible_mounts }}" loop_control: label: "{{ item.mount }}" when: item['device'].startswith('/dev') and not 'bind' in item['options'] @@ -163,7 +163,7 @@ - name: "6.1.10 | AUDIT | Ensure no unowned files or directories exist | Displaying any unowned files or directories" ansible.builtin.debug: msg: "Warning !! Manual intervention is required -- missing owner on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}" - with_items: "{{ rhel_09_6_1_10_audit.results }}" + loop: "{{ rhel_09_6_1_10_audit.results }}" when: - item.stdout_lines is defined - item.stdout_lines | length > 0 @@ -194,7 +194,7 @@ failed_when: false changed_when: false register: rhel_09_6_1_11_audit - with_items: "{{ ansible_mounts }}" + loop: "{{ ansible_mounts }}" loop_control: label: "{{ item.mount }}" when: item['device'].startswith('/dev') and not 'bind' in item['options'] @@ -202,7 +202,7 @@ - name: "6.1.11 | AUDIT | Ensure no ungrouped files or directories exist | Displaying all ungrouped files or directories" ansible.builtin.debug: msg: "Warning !! Manual intervention is required -- missing group on items in {{ item.item.mount }}: {{ item.stdout_lines | join(', ') }}" - with_items: "{{ rhel_09_6_1_11_audit.results }}" + loop: "{{ rhel_09_6_1_11_audit.results }}" when: - item.stdout_lines is defined - item.stdout_lines | length > 0 @@ -245,14 +245,14 @@ failed_when: false changed_when: false register: rhel_09_6_1_13_perms_results - with_items: "{{ ansible_mounts }}" + loop: "{{ ansible_mounts }}" loop_control: label: "{{ item.mount }}" - name: "6.1.13 | AUDIT | Audit SUID executables | Alert SUID executables exist" ansible.builtin.debug: msg: "Warning!! Manual intervention is required -- SUID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}" - with_items: "{{ rhel_09_6_1_13_perms_results.stdout_lines }}" + loop: "{{ rhel_09_6_1_13_perms_results.stdout_lines }}" when: - rhel_09_6_1_13_perms_results.stdout is defined @@ -279,14 +279,14 @@ failed_when: false changed_when: false register: rhel_09_6_1_14_perms_results - with_items: "{{ ansible_mounts }}" + loop: "{{ ansible_mounts }}" loop_control: label: "{{ item.mount }}" - name: "6.1.14 | AUDIT | Audit SGID executables | Alert SGID executables exist" ansible.builtin.debug: msg: "Manual intervention is required -- SGID set on items in {{ item.item.mount }}: {{ item.stout_lines | join(', ') }}" - with_items: "{{ rhel_09_6_1_14_perms_results.stdout_lines }}" + loop: "{{ rhel_09_6_1_14_perms_results.stdout_lines }}" when: - rhel_09_6_1_14_perms_results.stdout is defined diff --git a/tasks/section_6/cis_6.2.x.yml b/tasks/section_6/cis_6.2.x.yml index ff30b6e..2a98e90 100644 --- a/tasks/section_6/cis_6.2.x.yml +++ b/tasks/section_6/cis_6.2.x.yml @@ -33,7 +33,7 @@ ansible.builtin.shell: passwd -l {{ item }} changed_when: false failed_when: false - with_items: "{{ empty_password_accounts.stdout_lines }}" + loop: "{{ empty_password_accounts.stdout_lines }}" when: - empty_password_accounts.rc - rhel9cis_rule_6_2_2 @@ -225,7 +225,7 @@ state=directory owner=root mode='o-w,g-w' - with_items: "{{ rhel9cis_6_2_8_dot_in_path.stdout_lines }}" + loop: "{{ rhel9cis_6_2_8_dot_in_path.stdout_lines }}" when: - rhel9cis_rule_6_2_8 tags: @@ -239,7 +239,7 @@ ansible.builtin.shell: passwd -l {{ item }} changed_when: false failed_when: false - with_items: "{{ rhel9cis_uid_zero_accounts_except_root.stdout_lines }}" + loop: "{{ rhel9cis_uid_zero_accounts_except_root.stdout_lines }}" when: - rhel9cis_uid_zero_accounts_except_root.rc - rhel9cis_rule_6_2_9 @@ -257,7 +257,7 @@ ansible.builtin.stat: path: "{{ item }}" register: rhel_09_6_2_10_audit - with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '<=', max_int_uid | int ) | map(attribute='dir') | list }}" + loop: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '<=', max_int_uid | int ) | map(attribute='dir') | list }}" - name: "6.2.10 | AUDIT | Ensure local interactive user home directories exist" ansible.builtin.shell: find -H {{ item.0 | quote }} -not -type l -perm /027 @@ -321,7 +321,7 @@ path: "{{ item.dir }}" owner: "{{ item.id }}" state: directory - with_items: "{{ rhel9cis_passwd }}" + loop: "{{ rhel9cis_passwd }}" loop_control: label: "{{ rhel9cis_passwd_label }}" when: @@ -342,7 +342,7 @@ - name: "6.2.12 | AUDIT | Ensure local interactive user home directories are mode 750 or more restrictive" ansible.builtin.stat: path: "{{ item }}" - with_items: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int) | selectattr('uid', '<=', max_int_uid | int) | map(attribute='dir') | list }}" + loop: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int) | selectattr('uid', '<=', max_int_uid | int) | map(attribute='dir') | list }}" register: rhel_09_6_2_12_audit - name: "6.2.12 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive" @@ -365,14 +365,14 @@ recurse: true mode: a-st,g-w,o-rwx register: rhel_09_6_2_12_patch - when: - - not ansible_check_mode - - item.1.exists with_together: - "{{ rhel_09_6_2_12_audit.results | map(attribute='item') | list }}" - "{{ rhel_09_6_2_12_audit.results | map(attribute='stat') | list }}" loop_control: label: "{{ item.0 }}" + when: + - not ansible_check_mode + - item.1.exists # set default ACLs so the homedir has an effective umask of 0027 - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive" @@ -407,8 +407,7 @@ ansible.builtin.file: path: "{{ item }}/.netrc" state: absent - with_items: - - "{{ interactive_users_home.stdout_lines }}" + loop: "{{ interactive_users_home.stdout_lines }}" when: - rhel9cis_rule_6_2_13 tags: @@ -423,8 +422,7 @@ ansible.builtin.file: path: "{{ item }}/.forward" state: absent - with_items: - - "{{ interactive_users_home.stdout_lines }}" + loop: "{{ interactive_users_home.stdout_lines }}" when: - rhel9cis_rule_6_2_14 tags: @@ -439,8 +437,7 @@ ansible.builtin.file: path: "~{{ item }}/.rhosts" state: absent - with_items: - - "{{ interactive_users_home.stdout_lines }}" + loop: "{{ interactive_users_home.stdout_lines }}" when: - rhel9cis_rule_6_2_15 tags: