suditd improvements

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_4/cis_4.1.2.x.yml

@@ -5,6 +5,7 @@
       path: /etc/audit/auditd.conf
       regexp: "^max_log_file( |=)"
       line: "max_log_file = {{ rhel9cis_max_log_file_size }}"
+  register: rule_4_1_2_1
   notify: restart auditd
   when:
       - rhel9cis_rule_4_1_2_1
@@ -21,6 +22,7 @@
       path: /etc/audit/auditd.conf
       regexp: "^max_log_file_action"
       line: "max_log_file_action = {{ rhel9cis_auditd['max_log_file_action'] }}"
+  register: rule_4_1_2_2
   notify: restart auditd
   when:
       - rhel9cis_rule_4_1_2_2
@@ -37,6 +39,7 @@
       path: /etc/audit/auditd.conf
       regexp: "{{ item.regexp }}"
       line: "{{ item.line }}"
+  register: rule_4_1_2_3
   notify: restart auditd
   with_items:
       - { regexp: '^admin_space_left_action', line: 'admin_space_left_action = {{ rhel9cis_auditd.admin_space_left_action }}' }

tasks/section_4/cis_4.1.3.x.yml

@@ -1,10 +1,8 @@
 ---
 
 - name: "4.1.3.1 | PATCH | Ensure changes to system administration scope (sudoers) is collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_1
   tags:
@@ -16,10 +14,8 @@
       - rule_4.1.3.1
 
 - name: "4.1.3.2 | PATCH | Ensure actions as another user are always logged"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_2
   tags:
@@ -31,10 +27,8 @@
       - rule_4.1.3.2
 
 - name: "4.1.3.3 | PATCH | Ensure events that modify the sudo log file are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_3
   tags:
@@ -46,10 +40,8 @@
       - rule_4.1.3.3
 
 - name: "4.1.3.4 | PATCH | Ensure events that modify date and time information are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_4
   tags:
@@ -61,10 +53,8 @@
       - rule_4.1.3.4
 
 - name: "4.1.3.5 | PATCH | Ensure events that modify the system's network environment are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_5
   tags:
@@ -85,9 +75,8 @@
         register: priv_procs
 
       - name: "4.1.3.6 | PATCH | Ensure use of privileged commands is collected"
-        debug:
-            msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-        changed_when: true
+        set_fact:
+            update_audit_template: true
         notify: update auditd
   when:
       - rhel9cis_rule_4_1_3_6
@@ -100,10 +89,8 @@
       - rule_4.1.3.6
 
 - name: "4.1.3.7 | PATCH | Ensure unsuccessful unauthorized file access attempts are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_7
   tags:
@@ -115,10 +102,8 @@
       - rule_4.1.3_7
 
 - name: "4.1.3.8 | PATCH | Ensure events that modify user/group information are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_8
   tags:
@@ -130,10 +115,8 @@
       - rule_4.1.3.8
 
 - name: "4.1.3.9 | PATCH | Ensure discretionary access control permission modification events are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_9
   tags:
@@ -145,10 +128,8 @@
       - rule_4.1.3.9
 
 - name: "4.1.3.10 | PATCH | Ensure successful file system mounts are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_10
   tags:
@@ -160,10 +141,8 @@
       - rule_4.1.3.10
 
 - name: "4.1.3.11 | PATCH | Ensure session initiation information is collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_11
   tags:
@@ -175,10 +154,8 @@
       - rule_4.1.3.11
 
 - name: "4.1.3.12 | PATCH | Ensure login and logout events are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_12
   tags:
@@ -190,10 +167,8 @@
       - rule_4.1.3.12
 
 - name: "4.1.3.13 | PATCH | Ensure file deletion events by users are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_13
   tags:
@@ -204,10 +179,8 @@
       - rule_4.1.3.13
 
 - name: "4.1.3.14 | PATCH | Ensure events that modify the system's Mandatory Access Controls are collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_14
   tags:
@@ -219,10 +192,8 @@
       - rule_4.1.3.14
 
 - name: "4.1.3.15 | PATCH | Ensure successful and unsuccessful attempts to use the chcon command are recorded"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_15
   tags:
@@ -234,10 +205,8 @@
       - rule_4.1.3.15
 
 - name: "4.1.3.16 | PATCH | Ensure successful and unsuccessful attempts to use the setfacl command are recorded"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_16
   tags:
@@ -249,10 +218,8 @@
       - rule_4.1.3.16
 
 - name: "4.1.3.17 | PATCH | Ensure successful and unsuccessful attempts to use the chacl command are recorded"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_17
   tags:
@@ -264,10 +231,8 @@
       - rule_4.1.3.17
 
 - name: "4.1.3.18 | PATCH | Ensure successful and unsuccessful attempts to use the usermod command are recorded"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_18
   tags:
@@ -279,10 +244,8 @@
       - rule_4.1.3.18
 
 - name: "4.1.3.19 | PATCH | Ensure kernel module loading and unloading is collected"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_19
   tags:
@@ -294,10 +257,8 @@
       - rule_4.1.3.19
 
 - name: "4.1.3.20 | PATCH | Ensure the audit configuration is immutable"
-  debug:
-      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
-  changed_when: true
-  notify: update auditd
+  set_fact:
+      update_audit_template: true
   when:
       - rhel9cis_rule_4_1_3_20
   tags:
@@ -321,3 +282,10 @@
       - patch
       - auditd
       - rule_4.1.3.21
+
+- name: Auditd | 4.1.3 | Auditd controls updated
+  debug:
+      msg: "Auditd Controls handled in POST using template - updating /etc/auditd/rules.d/99_auditd.rules"
+  changed_when: false
+  when:
+      - update_audit_template