Initial

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_4/cis_4.1.2.x.yml

@@ -0,0 +1,53 @@
+---
+
+- name: "4.1.2.1 | L2 | PATCH | Ensure audit log storage size is configured"
+  lineinfile:
+      dest: /etc/audit/auditd.conf
+      regexp: "^max_log_file( |=)"
+      line: "max_log_file = {{ rhel9cis_max_log_file_size }}"
+      state: present
+  notify: restart auditd
+  when:
+      - rhel9cis_rule_4_1_2_1
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.2.1
+
+- name: "4.1.2.2 | L2 | PATCH | Ensure audit logs are not automatically deleted"
+  lineinfile:
+      dest: /etc/audit/auditd.conf
+      regexp: "^max_log_file_action"
+      line: "max_log_file_action = {{ rhel9cis_auditd['max_log_file_action'] }}"
+      state: present
+  notify: restart auditd
+  when:
+      - rhel9cis_rule_4_1_2_2
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.2.2
+
+- name: "4.1.2.3 | L2 | PATCH | Ensure system is disabled when audit logs are full"
+  lineinfile:
+      dest: /etc/audit/auditd.conf
+      regexp: "{{ item.regexp }}"
+      line: "{{ item.line }}"
+      state: present
+  notify: restart auditd
+  with_items:
+      - { regexp: '^admin_space_left_action', line: 'admin_space_left_action = {{ rhel9cis_auditd.admin_space_left_action }}' }
+      - { regexp: '^action_mail_acct', line: 'action_mail_acct = {{ rhel9cis_auditd.action_mail_acct }}' }
+      - { regexp: '^space_left_action', line: 'space_left_action = {{ rhel9cis_auditd.space_left_action }}' }
+  when:
+      - rhel9cis_rule_4_1_2_3
+  tags:
+      - level2-server
+      - level2-workstation
+      - auditd
+      - patch
+      - rule_4.1.2.3