sr2/RHEL9-CIS
4
0
Fork 0
forked from ansible-lockdown/RHEL9-CIS
Code Activity

Address issues in 4.1.1.2 and 4.1.1.3 including idempotent status (#188)

Browse source 
* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Signed-off-by: John Foster <robopickle@proton.me>

* Fixed issues with 4.1.1.2 and 4.1.1.3
Now handle multiple kernels and are idempotent

Removed debug messages

Signed-off-by: John Foster <robopickle@proton.me>

---------

Signed-off-by: John Foster <robopickle@proton.me>
This commit is contained in:
RoboPickle 2024-03-14 17:13:34 +00:00 • committed by GitHub
parent 7d7b6132f4
commit 6eeae19517
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 24 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

30
tasks/section_4/cis_4.1.1.x.yml
View file

@ -25,7 +25,7 @@
- name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled" - name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled"
block: block:
- name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby existence of current value" - name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby existence of current value"
ansible.builtin.shell: grubby --info=ALL | grep args | grep -o -E "audit=([[:digit:]])+" | grep -o -E "([[:digit:]])+" ansible.builtin.shell: grubby --info=ALL | grep args | sed -n 's/.*audit=\([[:alnum:]]\+\).*/\1/p'
changed_when: false changed_when: false
failed_when: false failed_when: false
check_mode: false check_mode: false
@ -34,7 +34,9 @@
- name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby update, if needed" - name: "4.1.1.2 | PATCH | Ensure auditing for processes that start prior to auditd is enabled | Grubby update, if needed"
ansible.builtin.shell: grubby --update-kernel=ALL --args="audit=1" ansible.builtin.shell: grubby --update-kernel=ALL --args="audit=1"
when: when:
- rhel9cis_4_1_1_2_grubby_curr_value_audit_linux is not defined or rhel9cis_4_1_1_2_grubby_curr_value_audit_linux | int != 1 - rhel9cis_4_1_1_2_grubby_curr_value_audit_linux.stdout == '' or
'0' in rhel9cis_4_1_1_2_grubby_curr_value_audit_linux.stdout or
'off' in rhel9cis_4_1_1_2_grubby_curr_value_audit_linux.stdout|lower
when: when:
- rhel9cis_rule_4_1_1_2 - rhel9cis_rule_4_1_1_2
tags: tags:
@ -48,16 +50,32 @@
- name: "4.1.1.3 | PATCH | Ensure audit_backlog_limit is sufficient" - name: "4.1.1.3 | PATCH | Ensure audit_backlog_limit is sufficient"
block: block:
- name: "4.1.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby existence of current value" - name: "4.1.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby existence of current value"
ansible.builtin.shell: grubby --info=ALL | grep args | grep -o -E "audit_backlog_limit=([[:digit:]])+" | grep -o -E "([[:digit:]])+" ansible.builtin.shell:
cmd: 'grubby --info=ALL | grep args | grep -o -E "audit_backlog_limit=([[:digit:]])+" | grep -o -E "([[:digit:]])+"'
changed_when: false changed_when: false
failed_when: false failed_when: false
check_mode: false check_mode: false
register: rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux register: rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux
- name: "4.1.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby update, if needed" - name: "4.1.1.3 | AUDIT | Check to see if limits are set"
ansible.builtin.shell: grubby --update-kernel=ALL --args="audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}" ansible.builtin.set_fact:
rhel9cis_4_1_1_3_reset_backlog_limits: true
when: when:
- rhel9cis_4_1_1_2_grubby_curr_value_audit_linux is not defined or rhel9cis_4_1_1_2_grubby_curr_value_audit_linux.stdout | int < rhel9cis_audit_back_log_limit - rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux is not defined or
rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux.stdout_lines == []
- name: "4.1.1.3 | AUDIT | Check to see if any limits are too low"
ansible.builtin.set_fact:
rhel9cis_4_1_1_3_reset_backlog_limits: true
when:
- (item | int < rhel9cis_audit_back_log_limit)
loop: "{{ rhel9cis_4_1_1_3_grubby_curr_value_backlog_linux.stdout_lines }}"
- name: "4.1.1.3 | AUDIT | Ensure audit_backlog_limit is sufficient | Grubby update applied"
ansible.builtin.shell:
cmd: 'grubby --update-kernel=ALL --args="audit_backlog_limit={{ rhel9cis_audit_back_log_limit }}"'
when:
- rhel9cis_4_1_1_3_reset_backlog_limits is defined
when: when:
- rhel9cis_rule_4_1_1_3 - rhel9cis_rule_4_1_1_3
tags: tags: