forked from ansible-lockdown/RHEL9-CIS
tidy up layout
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
9f829accd0
commit
6ed7c7e420
1 changed files with 16 additions and 32 deletions
|
|
@ -1,8 +1,7 @@
|
|||
---
|
||||
|
||||
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_1
|
||||
when: rhel9cis_rule_1_1_1_1
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -35,8 +34,7 @@
|
|||
state: absent
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_2
|
||||
when: rhel9cis_rule_1_1_1_2
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -62,15 +60,13 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Disable freevxfs"
|
||||
when:
|
||||
- not system_is_container
|
||||
when: not system_is_container
|
||||
community.general.modprobe:
|
||||
name: freevxfs
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_3
|
||||
when: rhel9cis_rule_1_1_1_3
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -96,15 +92,13 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Disable hfs"
|
||||
when:
|
||||
- not system_is_container
|
||||
when: not system_is_container
|
||||
community.general.modprobe:
|
||||
name: hfs
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_4
|
||||
when: rhel9cis_rule_1_1_1_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -130,15 +124,13 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Disable hfsplus"
|
||||
when:
|
||||
- not system_is_container
|
||||
when: not system_is_container
|
||||
community.general.modprobe:
|
||||
name: hfsplus
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_5
|
||||
when: rhel9cis_rule_1_1_1_5
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -164,15 +156,13 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Disable jffs2"
|
||||
when:
|
||||
- not system_is_container
|
||||
when: not system_is_container
|
||||
community.general.modprobe:
|
||||
name: jffs2
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_6
|
||||
when: rhel9cis_rule_1_1_1_6
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -198,15 +188,13 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Disable squashfs"
|
||||
when:
|
||||
- not system_is_container
|
||||
when: not system_is_container
|
||||
community.general.modprobe:
|
||||
name: squashfs
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_7
|
||||
when: rhel9cis_rule_1_1_1_7
|
||||
tags:
|
||||
- level2-server
|
||||
- level2-workstation
|
||||
|
|
@ -232,15 +220,13 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Disable udf"
|
||||
when:
|
||||
- not system_is_container
|
||||
when: not system_is_container
|
||||
community.general.modprobe:
|
||||
name: udf
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_8
|
||||
when: rhel9cis_rule_1_1_1_8
|
||||
tags:
|
||||
- level1-server
|
||||
- level2-workstation
|
||||
|
|
@ -266,15 +252,13 @@
|
|||
mode: '0600'
|
||||
|
||||
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Disable usb"
|
||||
when:
|
||||
- not system_is_container
|
||||
when: not system_is_container
|
||||
community.general.modprobe:
|
||||
name: usb-storage
|
||||
state: absent
|
||||
|
||||
- name: "1.1.1.9 | PATCH | Ensure unused filesystems kernel modules are not available"
|
||||
when:
|
||||
- rhel9cis_rule_1_1_1_9
|
||||
when: rhel9cis_rule_1_1_1_9
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue