control updates and lint

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_6/cis_6.2.x.yml

@@ -218,9 +218,6 @@
               register: root_path_perms
               loop: "{{ root_paths | split(':') }}"
 
-            - ansible.builtin.debug:
-                  msg: "{{ root_path_perms.results }}"
-
             - name: "6.2.8 | AUDIT | Ensure root PATH Integrity | Check for owner and permissions"
               ansible.builtin.file:
                   path: "{{ item.stat.path }}"
@@ -264,58 +261,36 @@
 
 - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist"
   block:
-      - name: "6.2.10 | AUDIT | Ensure local interactive user home directories exist"
+      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Create dir if absent"
-        ansible.builtin.stat:
-            path: "{{ item }}"
-        register: rhel_09_6_2_10_audit
-        loop: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '<=', max_int_uid | int ) | map(attribute='dir') | list }}"
-
-      - name: "6.2.10 | AUDIT | Ensure local interactive user home directories exist"
-        ansible.builtin.shell: find -H {{ item.0 | quote }} -not -type l -perm /027
-        changed_when: false
-        check_mode: false
-        register: rhel_09_6_2_10_patch_audit
-        with_together:
-            - "{{ rhel_09_6_2_10_audit.results | map(attribute='item') | list }}"
-            - "{{ rhel_09_6_2_10_audit.results | map(attribute='stat') | list }}"
-        loop_control:
-            label: "{{ item.0 }}"
-        when:
-            - ansible_check_mode
-            - item.1.exists
-
-      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist"
         ansible.builtin.file:
-            path: "{{ item.0 }}"
+            path: "{{ item.dir }}"
-            recurse: true
+            state: directory
-            mode: a-st,g-w,o-rwx
+            owner: "{{ item.id }}"
-        register: rhel_09_6_2_10_patch
+            group: "{{ item.gid }}"
-        with_together:
+        register: rhel_09_6_2_10_home_dir
-            - "{{ rhel_09_6_2_10_audit.results | map(attribute='item') | list }}"
+        loop: "{{ rhel9cis_passwd  | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '<=', max_int_uid | int ) | list }}"
-            - "{{ rhel_09_6_2_10_audit.results | map(attribute='stat') | list }}"
         loop_control:
-            label: "{{ item.0 }}"
+            label: "{{ item.id }}"
-        when:
-            - not ansible_check_mode
-            - item.1.exists
 
       # set default ACLs so the homedir has an effective umask of 0027
-      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist"
+      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Set group ACL"
         ansible.posix.acl:
-            path: "{{ item.0 }}"
+            path: "{{ item }}"
             default: true
+            etype: group
+            permissions: rx
             state: present
-            recursive: true
+        loop: "{{ interactive_users_home.stdout_lines }}"
-            etype: "{{ item.1.etype }}"
+        when: not system_is_container
-            permissions: "{{ item.1.mode }}"
+
-        with_nested:
+      - name: "6.2.10 | PATCH | Ensure local interactive user home directories exist | Set other ACL"
-            - "{{ (ansible_check_mode | ternary(rhel_09_6_2_10_patch_audit, rhel_09_6_2_10_patch)).results |
+        ansible.posix.acl:
-              rejectattr('skipped', 'defined') | map(attribute='item') | map('first') | list }}"
+            path: "{{ item }}"
-            -
+            default: true
-                - etype: group
+            etype: other
-                  mode: rx
+            permissions: 0
-                - etype: other
+            state: present
-                  mode: '0'
+        loop: "{{ interactive_users_home.stdout_lines }}"
         when: not system_is_container
   when:
       - rhel9cis_rule_6_2_10
@@ -331,9 +306,9 @@
       path: "{{ item.dir }}"
       owner: "{{ item.id }}"
       state: directory
-  loop: "{{ rhel9cis_passwd }}"
+  loop: "{{ rhel9cis_passwd  | selectattr('uid', '>=', min_int_uid | int ) | selectattr('uid', '<=', max_int_uid | int ) | list }}"
   loop_control:
-      label: "{{ rhel9cis_passwd_label }}"
+      label: "{{ item.id }}"
   when:
       - item.uid >= min_int_uid | int
       - item.id != 'nobody'
@@ -349,60 +324,43 @@
 
 - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive"
   block:
-      - name: "6.2.12 | AUDIT | Ensure local interactive user home directories are mode 750 or more restrictive"
+      - name: "6.2.12 | AUDIT | Ensure local interactive user home directories are mode 750 or more restrictive | get stat"
         ansible.builtin.stat:
             path: "{{ item }}"
-        loop: "{{ rhel9cis_passwd | selectattr('uid', '>=', min_int_uid | int) | selectattr('uid', '<=', max_int_uid | int) | map(attribute='dir') | list }}"
+        register: rhel_09_6_2_12_home_dir_perms
-        register: rhel_09_6_2_12_audit
+        loop: "{{ interactive_users_home.stdout_lines }}"
 
-      - name: "6.2.12 | AUDIT | Ensure users' home directories permissions are 750 or more restrictive"
+      - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive | amend if needed"
-        ansible.builtin.shell: find -H {{ item.0 | quote }} -not -type l -perm /027
-        check_mode: false
-        changed_when: rhel_09_6_2_12_patch_audit.stdout | length > 0
-        register: rhel_09_6_2_12_patch_audit
-        with_together:
-            - "{{ rhel_09_6_2_12_audit.results | map(attribute='item') | list }}"
-            - "{{ rhel_09_6_2_12_audit.results | map(attribute='stat') | list }}"
-        loop_control:
-            label: "{{ item.0 }}"
-        when:
-            - ansible_check_mode
-            - item.1.exists
-
-      - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive"
         ansible.builtin.file:
-            path: "{{ item.0 }}"
+            path: "{{ item.stat.path }}"
-            recurse: true
+            state: directory
-            mode: a-st,g-w,o-rwx
+            mode: "0750"
-        register: rhel_09_6_2_12_patch
+        loop: "{{ rhel_09_6_2_12_home_dir_perms.results }}"
-        with_together:
-            - "{{ rhel_09_6_2_12_audit.results | map(attribute='item') | list }}"
-            - "{{ rhel_09_6_2_12_audit.results | map(attribute='stat') | list }}"
         loop_control:
-            label: "{{ item.0 }}"
+            label: "{{ item }}"
         when:
-            - not ansible_check_mode
+            - item.stat.mode > '0750'
-            - item.1.exists
 
       # set default ACLs so the homedir has an effective umask of 0027
-      - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive"
+      - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive | Set group ACL"
         ansible.posix.acl:
-            path: "{{ item.0 }}"
+            path: "{{ item }}"
             default: true
+            etype: group
+            permissions: rx
             state: present
-            recursive: true
+        loop: "{{ interactive_users_home.stdout_lines }}"
-            etype: "{{ item.1.etype }}"
+        when: not system_is_container
-            permissions: "{{ item.1.mode }}"
+
-        with_nested:
+      - name: "6.2.12 | PATCH | Ensure local interactive user home directories are mode 750 or more restrictive | Set other ACL"
-            - "{{ (ansible_check_mode | ternary(rhel_09_6_2_12_patch_audit, rhel_09_6_2_12_patch)).results |
+        ansible.posix.acl:
-              rejectattr('skipped', 'defined') | map(attribute='item') | map('first') | list }}"
+            path: "{{ item }}"
-            -
+            default: true
-                - etype: group
+            etype: other
-                  mode: rx
+            permissions: 0
-                - etype: other
+            state: present
-                  mode: '0'
+        loop: "{{ interactive_users_home.stdout_lines }}"
-        when:
+        when: not system_is_container
-            - not system_is_container
   when:
       - rhel9cis_rule_6_2_12
   tags: