lint updates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_3/cis_3.1.x.yml

@@ -3,82 +3,93 @@
 # The CIS Control wants IPv6 disabled if not in use.
 # We are using the rhel9cis_ipv6_required to specify if you have IPv6 in use
 - name: "3.1.1 | PATCH | Ensure IPv6 status is identified"
-  block:
-      - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | refresh"
-        ansible.builtin.set_fact:
-            rhel9cis_sysctl_update: true
-            rhel9cis_flush_ipv6_route: true
-
-      - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | disable"
-        ansible.builtin.debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf"
   when:
-      - not rhel9cis_ipv6_required
-      - rhel9cis_rule_3_1_1
+    - not rhel9cis_ipv6_required
+    - rhel9cis_rule_3_1_1
   tags:
-      - level1-server
-      - level1-workstation
-      - manual
-      - patch
-      - ipv6
-      - networking
-      - rule_3.1.1
+    - level1-server
+    - level1-workstation
+    - manual
+    - patch
+    - ipv6
+    - networking
+    - rule_3.1.1
+    - NIST800-53R5_CM-7
+  block:
+    - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | refresh"
+      ansible.builtin.set_fact:
+        rhel9cis_sysctl_update: true
+        rhel9cis_flush_ipv6_route: true
+
+    - name: "3.1.1 | PATCH | Ensure IPv6 status is identified | disable"
+      ansible.builtin.debug:
+        msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-disable_ipv6.conf"
 
 - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled"
-  block:
-      - name: "3.1.2 | AUDIT | Ensure wireless interfaces are disabled | Check if nmcli command is available | if wlan exists"
-        ansible.builtin.shell: rpm -q NetworkManager
-        changed_when: false
-        failed_when: false
-        check_mode: false
-        register: rhel_09_nmcli_available
-
-      - name: "3.1.2 | AUDIT | Ensure wireless interfaces are disabled | Check if wifi is enabled"
-        ansible.builtin.shell: nmcli radio wifi
-        register: rhel_09_wifi_enabled
-        changed_when: rhel_09_wifi_enabled.stdout != "disabled"
-        failed_when: false
-        when: rhel_09_nmcli_available.rc == 0
-
-      - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Disable wifi if enabled"
-        ansible.builtin.shell: nmcli radio all off
-        changed_when: false
-        failed_when: false
-        when: rhel_09_wifi_enabled is changed  # noqa no-handler
   when:
-      - rhel9cis_rule_3_1_2
-      - "'wlan' in ansible_facts.interfaces"
+    - rhel9cis_rule_3_1_2
+    - discover_wireless_adapters.rc == 0
   tags:
-      - level1-server
-      - patch
-      - wireless
-      - rule_3.1.2
-
-- name: "3.1.3 | PATCH | Ensure TIPC is disabled"
+    - level1-server
+    - patch
+    - rule_3.1.2
+    - wireless
+    - NIST800-53R5_CM-7
+  vars:
+    warn_control_id: '3.1.2'
   block:
-      - name: "3.1.3 | PATCH | Ensure TIPC is disabled"
-        ansible.builtin.template:
-            src: "etc/modprobe.d/modprobe.conf.j2"
-            dest: "/etc/modprobe.d/{{ item }}.conf"
-            mode: '0600'
-            owner: root
-            group: root
-        loop:
-            - tipc
-            # note the item used in the template
+    - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Check for network-manager tool"
+      when: "'network-manager' in ansible_facts.packages"
+      ansible.builtin.shell: nmcli radio wifi
+      changed_when: false
+      failed_when: false
+      check_mode: false
+      register: rhel9cis_3_1_2_wifi_status
 
-      - name: "3.1.3 | PATCH | Ensure TIPC is disabled | blacklist"
-        ansible.builtin.lineinfile:
-            path: /etc/modprobe.d/blacklist.conf
-            regexp: "^(#)?blacklist tipc(\\s|$)"
-            line: "blacklist tipc"
-            create: true
-            mode: '0600'
+    - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Disable wireless if network-manager installed"
+      when:
+        - "'network-manager' in ansible_facts.packages"
+        - "'enabled' in rhel9cis_3_1_2_wifi_status.stdout"
+      ansible.builtin.shell: nmcli radio all off
+      changed_when: rhel9cis_3_1_2_nmcli_radio_off.rc == 0
+      register: rhel9cis_3_1_2_nmcli_radio_off
+
+    - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Warn about wireless if network-manager not installed"
+      when: "'network-manager' not in ansible_facts.packages"
+      ansible.builtin.debug:
+        msg: "Warning!! You need to disable wireless interfaces manually since network-manager is not installed"
+
+    - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Set warning count"
+      when: "'network-manager' not in ansible_facts.packages"
+      ansible.builtin.import_tasks:
+        file: warning_facts.yml
+
+- name: "3.1.3 | PATCH | Ensure bluetooth services are not in use"
   when:
-      - rhel9cis_rule_3_1_3
+    - rhel9cis_rule_3_1_3
   tags:
-      - level2-server
-      - level2-workstation
-      - patch
-      - tipc
-      - rule_3.1.3
+    - level1-server
+    - level2-workstation
+    - patch
+    - bluetooth
+    - rule_3.1.3
+    - NIST800-53R5_CM-7
+  block:
+    - name: "3.1.3 | PATCH | Ensure bluetooth services are not in use | pkg"
+      when:
+        - not rhel9cis_bluetooth_service
+        - not rhel9cis_bluetooth_mask
+      ansible.builtin.package:
+        name: bluez
+        state: absent
+
+    - name: "3.1.3 | PATCH | Ensure bluetooth services are not in use | mask"
+      when:
+        - not rhel9cis_bluetooth_service
+        - rhel9cis_bluetooth_mask
+      notify: Systemd_daemon_reload
+      ansible.builtin.systemd:
+        name: bluetooth.service
+        enabled: false
+        state: stopped
+        masked: true