Updated audit rules for arch

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/auditd.yml

@@ -1,17 +1,30 @@
 ---
 
-- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | stat file
+# Since auditd rules are dependent on syscalls and syscall tables are architecture specific,
+# we need to update the auditd rules depending on the architecture of the system.
+# This task passed the syscalls table to the auditd template and updates the auditd rules
+
+- name: "POST | AUDITD | Set supported_syscalls variable"
+  ansible.builtin.shell: ausyscall --dump |  awk  '{print $2}'
+  changed_when: false
+  failed_when: discovered_auditd_syscalls.rc not in [ 0, 1 ]
+  register: discovered_auditd_syscalls
+
+- name: POST | AUDITD | Apply auditd template will for section 6.3.3 - only required rules will be added | stat file
   ansible.builtin.stat:
     path: /etc/audit/rules.d/99_auditd.rules
   register: discovered_auditd_rules_file
 
-- name: POST | AUDITD | Apply auditd template will for section 4.1.3 - only required rules will be added | setup file
+- name: POST | Apply auditd template for section 6.3.3.x
+  when: update_audit_template
+  vars:
+    supported_syscalls: "{{ discovered_auditd_syscalls.stdout_lines }}"
   ansible.builtin.template:
     src: audit/99_auditd.rules.j2
     dest: /etc/audit/rules.d/99_auditd.rules
     owner: root
     group: root
-    mode: '0640'
+    mode: 'u-x,go-wx'
   diff: "{{ discovered_auditd_rules_file.stat.exists }}"  # Only run diff if not a new file
   register: discovered_auditd_rules_template_updated
   notify: