lint updates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_3/cis_3.2.x.yml

@@ -1,52 +1,121 @@
 ---
 
-- name: "3.2.1 | PATCH | Ensure IP forwarding is disabled"
-  block:
-      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding | Set Fact"
-        ansible.builtin.set_fact:
-            rhel9cis_sysctl_update: true
-            rhel9cis_flush_ipv4_route: true
-
-      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv4 forwarding"
-        ansible.builtin.debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
-
-      - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | IPv6"
-        block:
-            - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding | Set Fact"
-              ansible.builtin.set_fact:
-                  rhel9cis_flush_ipv6_route: true
-
-            - name: "3.2.1 | PATCH | Ensure IP forwarding is disabled | Disable IPv6 forwarding"
-              ansible.builtin.debug:
-                  msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv6_sysctl.conf"
-
-        when: rhel9cis_ipv6_required
+- name: "3.2.1 | PATCH | Ensure dccp kernel module is not available"
   when:
-      - not rhel9cis_is_router
-      - rhel9cis_rule_3_2_1
+    - rhel9cis_rule_3_2_1
   tags:
-      - level1-server
-      - level1-workstation
-      - sysctl
-      - patch
-      - rule_3.2.1
-
-- name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
+    - level2-server
+    - level2-workstation
+    - patch
+    - rule_3.2.1
+    - dccp
+    - NIST800-53R5_CM-7
+    - NIST800-53R5_SI-4
   block:
-      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled | Set Fact"
-        ansible.builtin.set_fact:
-            rhel9cis_sysctl_update: true
-            rhel9cis_flush_ipv4_route: true
-      - name: "3.2.2 | PATCH | Ensure packet redirect sending is disabled"
-        ansible.builtin.debug:
-            msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-netipv4_sysctl.conf"
+    - name: "3.2.1 | PATCH | Ensure dccp kernel module is not available | modprobe"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/dccp.conf
+        regexp: '^(#)?install dccp(\\s|$)'
+        line: "{{ item }}"
+        create: true
+      loop:
+        - install dccp /bin/true
+        - blacklist dccp
+
+    - name: "3.2.1 | PATCH | Ensure dccp kernel module is not available | blacklist"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/blacklist.conf
+        regexp: "^(#)?blacklist cramfs(\\s|$)"
+        line: "blacklist cramfs"
+        create: true
+        mode: '0600'
+
+- name: "3.2.2 | PATCH | Ensure tipc kernel module is not available"
   when:
-      - not rhel9cis_is_router
-      - rhel9cis_rule_3_2_2
+    - rhel9cis_rule_3_2_2
   tags:
-      - level1-server
-      - level1-workstation
-      - patch
-      - sysctl
-      - rule_3.2.2
+    - level2-server
+    - level2-workstation
+    - patch
+    - rule_3.2.2
+    - tipc
+    - NIST800-53R5_CM-7
+    - NIST800-53R5_SI-4
+  block:
+    - name: "3.2.2 | PATCH | Ensure tipc kernel module is not available | modprobe"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/tipc.conf
+        regexp: '^(#)?install tipc(\\s|$)'
+        line: "{{ item }}"
+        create: true
+      loop:
+        - install tipc /bin/true
+        - blacklist tipc
+
+    - name: "3.2.2 | PATCH | Ensure tipc kernel module is not available | blacklist"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/blacklist.conf
+        regexp: "^(#)?blacklist tipc(\\s|$)"
+        line: "blacklist tipc"
+        create: true
+        mode: '0600'
+
+- name: "3.2.3 | PATCH | Ensure rds kernel module is not available"
+  when:
+    - rhel9cis_rule_3_2_3
+  tags:
+    - level2-server
+    - level2-workstation
+    - patch
+    - rule_3.2.3
+    - rds
+    - NIST800-53R5_CM-7
+    - NIST800-53R5_SI-4
+  block:
+    - name: "3.2.3 | PATCH | Ensure rds kernel module is not available | modprobe"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/rds.conf
+        regexp: '^(#)?install rds(\\s|$)'
+        line: "{{ item }}"
+        create: true
+      loop:
+        - install rds /bin/true
+        - blacklist rds
+
+    - name: "3.2.3 | PATCH | Ensure rds kernel module is not available | blacklist"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/blacklist.conf
+        regexp: "^(#)?blacklist rds(\\s|$)"
+        line: "blacklist rds"
+        create: true
+        mode: '0600'
+
+- name: "3.2.4 | PATCH | Ensure sctp kernel module is not available"
+  when:
+    - rhel9cis_rule_3_2_4
+  tags:
+    - level2-server
+    - level2-workstation
+    - patch
+    - rule_3.2.4
+    - sctp
+    - NIST800-53R5_CM-7
+    - NIST800-53R5_SI-4
+  block:
+    - name: "3.2.4 | PATCH | Ensure sctp kernel module is not available | modprobe"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/sctp.conf
+        regexp: '^(#)?install sctp(\\s|$)'
+        line: "{{ item }}"
+        create: true
+      loop:
+        - install sctp /bin/true
+        - blacklist sctp
+
+    - name: "3.2.4 | PATCH | Ensure sctp kernel module is not available | blacklist"
+      ansible.builtin.lineinfile:
+        path: /etc/modprobe.d/blacklist.conf
+        regexp: "^(#)?blacklist sctp(\\s|$)"
+        line: "blacklist sctp"
+        create: true
+        mode: '0600'