feat: become true for all tasks

handlers/main.yml

@@ -11,6 +11,7 @@
     state: present
     fstype: "{{ prelim_mount_point_fs_and_options[mount_point]['fs_type'] }}"
     opts: "{{ prelim_mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"
+  become: true
   listen: "Remount /tmp"
 
 - name: "Remounting /tmp"
@@ -19,6 +20,7 @@
   ansible.posix.mount:
     path: "{{ mount_point }}"
     state: remounted
+  become: true
   listen: "Remount /tmp"
 
 - name: "Remounting /tmp systemd"
@@ -28,6 +30,7 @@
     name: tmp.mount
     state: restarted
     daemon_reload: true
+  become: true
   listen: "Remount /tmp"
 
 - name: "Adding options for /dev/shm"
@@ -39,6 +42,7 @@
     state: present
     fstype: "{{ prelim_mount_point_fs_and_options[mount_point]['fs_type'] }}"
     opts: "{{ prelim_mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"
+  become: true
   listen: "Remount /dev/shm"
 
 - name: "Remounting /dev/shm"
@@ -47,6 +51,7 @@
   ansible.posix.mount:
     path: "{{ mount_point }}"
     state: remounted
+  become: true
   listen: "Remount /dev/shm"
 
 - name: "Adding options for /home"
@@ -58,6 +63,7 @@
     state: present
     fstype: "{{ prelim_mount_point_fs_and_options[mount_point]['fs_type'] }}"
     opts: "{{ prelim_mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"
+  become: true
   listen: "Remount /home"
 
 - name: "Remounting /home"
@@ -66,6 +72,7 @@
   ansible.posix.mount:
     path: "{{ mount_point }}"
     state: remounted
+  become: true
   listen: "Remount /home"
 
 - name: "Adding options for /var"
@@ -77,6 +84,7 @@
     state: present
     fstype: "{{ prelim_mount_point_fs_and_options[mount_point]['fs_type'] }}"
     opts: "{{ prelim_mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"
+  become: true
   listen: "Remount /var"
 
 - name: "Remounting /var"
@@ -85,6 +93,7 @@
   ansible.posix.mount:
     path: "{{ mount_point }}"
     state: remounted
+  become: true
   listen: "Remount /var"
 
 - name: "Adding options for /var/tmp"
@@ -96,6 +105,7 @@
     state: present
     fstype: "{{ prelim_mount_point_fs_and_options[mount_point]['fs_type'] }}"
     opts: "{{ prelim_mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"
+  become: true
   listen: "Remount /var/tmp"
 
 - name: "Remounting /var/tmp"
@@ -104,6 +114,7 @@
   ansible.posix.mount:
     path: "{{ mount_point }}"
     state: remounted
+  become: true
   listen: "Remount /var/tmp"
 
 - name: "Adding options for /var/log"
@@ -115,6 +126,7 @@
     state: present
     fstype: "{{ prelim_mount_point_fs_and_options[mount_point]['fs_type'] }}"
     opts: "{{ prelim_mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"
+  become: true
   listen: "Remount /var/log"
 
 - name: "Remounting /var/log"
@@ -123,6 +135,7 @@
   ansible.posix.mount:
     path: "{{ mount_point }}"
     state: remounted
+  become: true
   listen: "Remount /var/log"
 
 - name: "Adding options for /var/log/audit"
@@ -134,6 +147,7 @@
     state: present
     fstype: "{{ prelim_mount_point_fs_and_options[mount_point]['fs_type'] }}"
     opts: "{{ prelim_mount_point_fs_and_options[mount_point]['options'] | unique | join(',') }}"
+  become: true
   listen: "Remount /var/log/audit"
 
 - name: "Remounting /var/log/audit"
@@ -142,6 +156,7 @@
   ansible.posix.mount:
     path: "{{ mount_point }}"
     state: remounted
+  become: true
   listen: "Remount /var/log/audit"
 
 - name: "Remounting /boot/efi"
@@ -151,6 +166,7 @@
     path: "{{ mount_point }}"
     state: remounted
   notify: Set reboot required
+  become: true
   listen: "Remount /boot/efi"
 
 - name: Reload sysctl
@@ -260,12 +276,14 @@
 - name: Stop auditd process
   ansible.builtin.command: systemctl kill auditd
   changed_when: true
+  become: true
   listen: Restart auditd
 
 - name: Start auditd process
   ansible.builtin.systemd:
     name: auditd
     state: started
+  become: true
   listen: Restart auditd
 
 - name: Set reboot required

tasks/main.yml

@@ -1,7 +1,10 @@
 ---
 # tasks file for RHEL9-CIS
 
-- name: "Check OS version and family"
+- name: "RHEL9-CIS"
+  become: true
+  block:
+    - name: "Check OS version and family"
       when: os_check
       tags: always
       ansible.builtin.assert:
@@ -9,14 +12,14 @@
         fail_msg: "This role can only be run against Supported OSs. {{ ansible_facts.distribution }} {{ ansible_facts.distribution_major_version }} is not supported."
         success_msg: "This role is running against a supported OS {{ ansible_facts.distribution }} {{ ansible_facts.distribution_major_version }}"
     
-- name: "Check ansible version"
+    - name: "Check ansible version"
       tags: always
       ansible.builtin.assert:
         that: ansible_version.full is version_compare(min_ansible_version, '>=')
         fail_msg: "You must use Ansible {{ min_ansible_version }} or greater"
         success_msg: "This role is running a supported version of ansible {{ ansible_version.full }} >= {{ min_ansible_version }}"
     
-- name: "Setup rules if container"
+    - name: "Setup rules if container"
       when: ansible_connection == 'docker' or ansible_facts.virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
       tags:
         - container_discovery
@@ -35,13 +38,13 @@
           ansible.builtin.debug:
             msg: system has been discovered as a container
     
-- name: "Check crypto-policy input"
+    - name: "Check crypto-policy input"
       ansible.builtin.assert:
         that: rhel9cis_crypto_policy in rhel9cis_allowed_crypto_policies
         fail_msg: "Crypto policy is not a permitted version"
         success_msg: "Crypto policy is a permitted version"
     
-- name: "Check rhel9cis_bootloader_password variable has been changed"
+    - name: "Check rhel9cis_bootloader_password variable has been changed"
       when:
         - rhel9cis_set_boot_pass
         - rhel9cis_rule_1_4_1
@@ -50,7 +53,7 @@
         that: rhel9cis_bootloader_password_hash != 'grub.pbkdf2.sha512.changethispassword' or (rhel9cis_bootloader_salt != '' and rhel9cis_bootloader_password != 'password') # pragma: allowlist secret
         msg: "This role will not be able to run single user password commands as rhel9cis_bootloader_password or rhel9cis_bootloader_password_hash variable has not been set correctly"
     
-- name: "Check crypto-policy module input"
+    - name: "Check crypto-policy module input"
       when:
         - rhel9cis_crypto_policy_ansiblemanaged
         - rhel9cis_crypto_policy_module | length > 0
@@ -63,7 +66,7 @@
         fail_msg: "Crypto policy module is not a permitted version"
         success_msg: "Crypto policy module is a permitted version"
     
-- name: "Check password set for {{ ansible_env.SUDO_USER }}"
+    - name: "Check password set for {{ ansible_env.SUDO_USER }}"
       when:
         - rhel9cis_rule_5_2_4
         - ansible_env.SUDO_USER is defined
@@ -106,7 +109,7 @@
                 fail_msg: "You have {{ sudo_password_rule }} enabled but the user = {{ ansible_env.SUDO_USER }} is locked - It can break access"
                 success_msg: "The local account {{ ansible_env.SUDO_USER }} is not locked or included in the exception list for rule 5.2.4"
     
-- name: "Check authselect profile is selected"
+    - name: "Check authselect profile is selected"
       when: rhel9cis_allow_authselect_updates
       tags: always
       block:
@@ -121,7 +124,7 @@
           failed_when: prelim_authselect_profile_list.rc not in [ 0, 1 ]
           register: prelim_authselect_profile_list
     
-- name: "Ensure root password is set"
+    - name: "Ensure root password is set"
       when: rhel9cis_rule_5_4_2_4
       tags:
         - level1-server
@@ -143,76 +146,76 @@
             fail_msg: "You have rule 5.4.2.4 enabled this requires that you have a root password set"
             success_msg: "You have a root password set"
     
-- name: "Gather the package facts"
+    - name: "Gather the package facts"
       tags: always
       ansible.builtin.package_facts:
         manager: auto
     
-- name: "Include OS specific variables"
+    - name: "Include OS specific variables"
       tags: always
       ansible.builtin.include_vars:
         file: "{{ ansible_facts.distribution }}.yml"
     
-- name: "Include preliminary steps"
+    - name: "Include preliminary steps"
       tags: prelim_tasks
       ansible.builtin.import_tasks:
         file: prelim.yml
     
-- name: "Run Section 1 tasks"
+    - name: "Run Section 1 tasks"
       when: rhel9cis_section1
       ansible.builtin.import_tasks:
         file: section_1/main.yml
     
-- name: "Run Section 2 tasks"
+    - name: "Run Section 2 tasks"
       when: rhel9cis_section2
       ansible.builtin.import_tasks:
         file: section_2/main.yml
     
-- name: "Run Section 3 tasks"
+    - name: "Run Section 3 tasks"
       when: rhel9cis_section3
       ansible.builtin.import_tasks:
         file: section_3/main.yml
     
-- name: "Run Section 4 tasks"
+    - name: "Run Section 4 tasks"
       when: rhel9cis_section4
       ansible.builtin.import_tasks:
         file: section_4/main.yml
     
-- name: "Run Section 5 tasks"
+    - name: "Run Section 5 tasks"
       when: rhel9cis_section5
       ansible.builtin.import_tasks:
         file: section_5/main.yml
     
-- name: "Run Section 6 tasks"
+    - name: "Run Section 6 tasks"
       when: rhel9cis_section6
       ansible.builtin.import_tasks:
         file: section_6/main.yml
     
-- name: "Run Section 7 tasks"
+    - name: "Run Section 7 tasks"
       when: rhel9cis_section7
       ansible.builtin.import_tasks:
         file: section_7/main.yml
     
-- name: "Run auditd logic"
+    - name: "Run auditd logic"
       when: update_audit_template
       tags: always
       ansible.builtin.import_tasks:
         file: auditd.yml
     
-- name: "Run post remediation tasks"
+    - name: "Run post remediation tasks"
       tags:
         - post_tasks
         - always
       ansible.builtin.import_tasks:
         file: post.yml
     
-- name: "Run post_remediation audit"
+    - name: "Run post_remediation audit"
       when: run_audit
       tags: always
       ansible.builtin.import_tasks:
         file: post_remediation_audit.yml
     
-- name: Add ansible file showing Benchmark and levels applied if audit details not present
+    - name: Add ansible file showing Benchmark and levels applied if audit details not present
       when:
         - create_benchmark_facts
         - (post_audit_summary is defined) or
@@ -237,7 +240,7 @@
             group: root
             mode: 'u-x,go=r'
     
-- name: Fetch audit files
+    - name: Fetch audit files
       when:
         - fetch_audit_output
         - run_audit
@@ -245,13 +248,13 @@
       ansible.builtin.import_tasks:
         file: fetch_audit_output.yml
     
-- name: "Show Audit Summary"
+    - name: "Show Audit Summary"
       when: run_audit
       tags: always
       ansible.builtin.debug:
         msg: "{{ audit_results.split('\n') }}"
     
-- name: "If Warnings found Output count and control IDs affected"
+    - name: "If Warnings found Output count and control IDs affected"
       when: warn_count != 0
       tags: always
       ansible.builtin.debug: