sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

tidy up layout

Browse source 
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
Mark Bolwell 2024-12-04 08:03:33 +00:00
parent 9f829accd0
commit 6ed7c7e420
No known key found for this signature in database
GPG key ID: 997FF7FE93AEB5B9
1 changed files with 16 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

48
tasks/section_1/cis_1.1.1.x.yml
View file

@ -1,8 +1,7 @@
---
- name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_1
when: rhel9cis_rule_1_1_1_1
tags:
- level1-server
- level1-workstation
@ -35,8 +34,7 @@
state: absent
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_2
when: rhel9cis_rule_1_1_1_2
tags:
- level1-server
- level1-workstation
@ -62,15 +60,13 @@
mode: '0600'
- name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Disable freevxfs"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: freevxfs
state: absent
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_3
when: rhel9cis_rule_1_1_1_3
tags:
- level1-server
- level1-workstation
@ -96,15 +92,13 @@
mode: '0600'
- name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Disable hfs"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: hfs
state: absent
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available"
when:
- rhel9cis_rule_1_1_1_4
when: rhel9cis_rule_1_1_1_4
tags:
- level1-server
- level1-workstation
@ -130,15 +124,13 @@
mode: '0600'
- name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Disable hfsplus"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: hfsplus
state: absent
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available"
when:
- rhel9cis_rule_1_1_1_5
when: rhel9cis_rule_1_1_1_5
tags:
- level1-server
- level1-workstation
@ -164,15 +156,13 @@
mode: '0600'
- name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Disable jffs2"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: jffs2
state: absent
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available"
when:
- rhel9cis_rule_1_1_1_6
when: rhel9cis_rule_1_1_1_6
tags:
- level2-server
- level2-workstation
@ -198,15 +188,13 @@
mode: '0600'
- name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Disable squashfs"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: squashfs
state: absent
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available"
when:
- rhel9cis_rule_1_1_1_7
when: rhel9cis_rule_1_1_1_7
tags:
- level2-server
- level2-workstation
@ -232,15 +220,13 @@
mode: '0600'
- name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Disable udf"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: udf
state: absent
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available"
when:
- rhel9cis_rule_1_1_1_8
when: rhel9cis_rule_1_1_1_8
tags:
- level1-server
- level2-workstation
@ -266,15 +252,13 @@
mode: '0600'
- name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Disable usb"
when:
- not system_is_container
when: not system_is_container
community.general.modprobe:
name: usb-storage
state: absent
- name: "1.1.1.9 | PATCH | Ensure unused filesystems kernel modules are not available"
when:
- rhel9cis_rule_1_1_1_9
when: rhel9cis_rule_1_1_1_9
tags:
- level1-server
- level1-workstation