forked from ansible-lockdown/RHEL9-CIS
updated
Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>
This commit is contained in:
parent
dc5f71d461
commit
8c79bfe7fb
25 changed files with 253 additions and 266 deletions
|
|
@ -4,7 +4,7 @@
|
|||
debug:
|
||||
msg: "WARNING!! /tmp is not mounted on a separate partition"
|
||||
when:
|
||||
- rhel8cis_rule_1_1_2_1
|
||||
- rhel9cis_rule_1_1_2_1
|
||||
- ansible_mounts | selectattr('mount', 'match', '^/tmp$') | list | length == 0
|
||||
tags:
|
||||
- level1-server
|
||||
|
|
@ -24,7 +24,7 @@
|
|||
src: "{{ item.device }}"
|
||||
fstype: "{{ item.fstype }}"
|
||||
state: present
|
||||
opts: defaults,{% if rhel8cis_rule_1_1_2_2 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_2_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_2_4 %}nosuid{% endif %}
|
||||
opts: defaults,{% if rhel9cis_rule_1_1_2_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_2_3 %}noexec,{% endif %}{% if rhel9cis_rule_1_1_2_4 %}nosuid{% endif %}
|
||||
notify: remount tmp
|
||||
with_items:
|
||||
- "{{ ansible_mounts }}"
|
||||
|
|
@ -32,10 +32,10 @@
|
|||
label: "{{ item.device }}"
|
||||
when:
|
||||
- item.mount == "/tmp"
|
||||
- not rhel8cis_tmp_svc
|
||||
- rhel8cis_rule_1_1_2_2 or
|
||||
rhel8cis_rule_1_1_2_3 or
|
||||
rhel8cis_rule_1_1_2_4
|
||||
- not rhel9cis_tmp_svc
|
||||
- rhel9cis_rule_1_1_2_2 or
|
||||
rhel9cis_rule_1_1_2_3 or
|
||||
rhel9cis_rule_1_1_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
@ -60,11 +60,11 @@
|
|||
mode: 0644
|
||||
notify: systemd restart tmp.mount
|
||||
when:
|
||||
- rhel8cis_tmp_svc
|
||||
- rhel8cis_rule_1_1_2_1 or
|
||||
rhel8cis_rule_1_1_2_2 or
|
||||
rhel8cis_rule_1_1_2_3 or
|
||||
rhel8cis_rule_1_1_2_4
|
||||
- rhel9cis_tmp_svc
|
||||
- rhel9cis_rule_1_1_2_1 or
|
||||
rhel9cis_rule_1_1_2_2 or
|
||||
rhel9cis_rule_1_1_2_3 or
|
||||
rhel9cis_rule_1_1_2_4
|
||||
tags:
|
||||
- level1-server
|
||||
- level1-workstation
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue