Updated mountpoints controls

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_1/cis_1.1.2.1.x.yml

@@ -12,62 +12,104 @@
     - rule_1.1.2.1.1
     - NIST800-53R5_CM-7
   vars:
-    warn_control_id: '1.1.2.1.1'
-    required_mount: '/tmp'
+    warn_control_id: "1.1.2.1.1"
+    required_mount: "/tmp"
   block:
-    - name: "1.1.2.1.1 | PATCH | Ensure /tmp is a separate partition | Absent"
-      ansible.builtin.debug:
-        msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"
+    - name: "1.1.2.1.1 | AUDIT | Ensure /tmp is a separate partition | check for mount"
+      ansible.builtin.command: findmnt -kn "{{ required_mount }}"
+      changed_when: false
+      failed_when: discovered_tmp_mount.rc not in [ 0, 1 ]
+      register: discovered_tmp_mount
 
-    - name: "1.1.2.1.1 | PATCH | Ensure /tmp is a separate partition | Present"
+    - name: "1.1.2.1.1 | AUDIT | Ensure /tmp is a separate partition | Absent"
+      when: discovered_tmp_mount is undefined
+      ansible.builtin.debug:
+        msg: "Warning!! {{ required_mount }} is not mounted on a separate partition"
+
+    - name: "1.1.2.1.1 | AUDIT | Ensure /tmp is a separate partition | Present"
+      when: discovered_tmp_mount is undefined
       ansible.builtin.import_tasks:
         file: warning_facts.yml
 
 # via fstab
-- name: |
-    "1.1.2.1.2 | PATCH | Ensure nodev option set on /tmp partition"
-    "1.1.2.1.3 | PATCH | Ensure nosuid option set on /tmp partition"
-    "1.1.2.1.4 | PATCH | Ensure noexec option set on /tmp partition"
-  ansible.posix.mount:
-    name: /tmp
-    src: "{{ item.device }}"
-    fstype: "{{ item.fstype }}"
-    state: present
-    opts: "{{ item.options }}{% if ('nodev' not in item.options and rhel9cis_rule_1_1_2_1_2) %},nodev{% endif %}{% if ('nosuid' not in item.options and rhel9cis_rule_1_1_2_1_3) %},nosuid{% endif %}{% if ('noexec' not in item.options and rhel9cis_rule_1_1_2_1_4) %},noexec{% endif %}"
-  notify: Remount tmp
-  loop: "{{ ansible_facts.mounts }}"
-  loop_control:
-    label: "{{ item.device }}"
+- name: "1.1.2.1.2 | PATCH | Ensure nodev option set on /tmp partition"
   when:
-    - item.mount == "/tmp"
+    - mount_point_fs_and_options[mount_point] is defined
+    - not mount_point_fs_and_options[mount_point]['src'] == "tmpfs"
+    - rhel9cis_rule_1_1_2_1_2
     - not rhel9cis_tmp_svc
-    - rhel9cis_rule_1_1_2_1_2 or
-      rhel9cis_rule_1_1_2_1_3 or
-      rhel9cis_rule_1_1_2_1_4
   tags:
     - level1-server
     - level1-workstation
     - patch
     - mounts
     - rule_1.1.2.1.2
-    - rule_1.1.2.1.3
-    - rule_1.1.2.1.4
-    - NIST800-53R5_CM-7
     - NIST800-53R5_AC-3
     - NIST800-53R5_MP-2
+  vars:
+    mount_point: "/tmp"
+    required_option: nodev
+  notify: &mount_option_notify
+    - "Remount {{ mount_point }}"
+  ansible.builtin.set_fact: &mount_option_set_fact
+    mount_point_fs_and_options: |
+      {{ mount_point_fs_and_options | combine({mount_point: {'options': (mount_point_fs_and_options[mount_point]['options'] + [required_option])}}, recursive=True) }}
+  changed_when: &mount_option_changed_when
+    - required_option not in mount_point_fs_and_options[mount_point]['original_options']
+
+- name: "1.1.2.1.3 | PATCH | Ensure nosuid option set on /tmp partition"
+  when:
+    - mount_point_fs_and_options[mount_point] is defined
+    - not mount_point_fs_and_options[mount_point]['src'] == "tmpfs"
+    - rhel9cis_rule_1_1_2_1_3
+    - not rhel9cis_tmp_svc
+  tags:
+    - level1-server
+    - level1-workstation
+    - patch
+    - mounts
+    - rule_1.1.2.1.3
+    - NIST800-53R5_AC-3
+    - NIST800-53R5_MP-2
+  vars:
+    mount_point: "/tmp"
+    required_option: nosuid
+  notify: *mount_option_notify
+  ansible.builtin.set_fact:
+    <<: *mount_option_set_fact
+  changed_when: *mount_option_changed_when
+
+- name: "1.1.2.1.4 | PATCH | Ensure noexec option set on /tmp partition"
+  when:
+    - mount_point_fs_and_options[mount_point] is defined
+    - not mount_point_fs_and_options[mount_point]['src'] == "tmpfs"
+    - rhel9cis_rule_1_1_2_1_4
+    - not rhel9cis_tmp_svc
+  tags:
+    - level1-server
+    - level1-workstation
+    - patch
+    - mounts
+    - rule_1.1.2.1.4
+    - NIST800-53R5_AC-3
+    - NIST800-53R5_MP-2
+  vars:
+    mount_point: "/tmp"
+    required_option: noexec
+  notify: *mount_option_notify
+  ansible.builtin.set_fact:
+    <<: *mount_option_set_fact
+  changed_when: *mount_option_changed_when
 
 # via systemd
 - name: |
-    "1.1.2.1.1 | PATCH | Ensure /tmp is configured"
-    "1.1.2.1.2 | PATCH | Ensure nodev option set on /tmp partition"
-    "1.1.2.1.3 | PATCH | Ensure noexec option set on /tmp partition"
-    "1.1.2.1.4 | PATCH | Ensure nosuid option set on /tmp partition"
+    "1.1.2.1.1 | PATCH | Ensure /tmp is configured
+    1.1.2.1.2 | PATCH | Ensure nodev option set on /tmp partition
+    1.1.2.1.3 | PATCH | Ensure noexec option set on /tmp partition
+    1.1.2.1.4 | PATCH | Ensure nosuid option set on /tmp partition"
   when:
     - rhel9cis_tmp_svc
-    - rhel9cis_rule_1_1_2_1_1 or
-      rhel9cis_rule_1_1_2_1_2 or
-      rhel9cis_rule_1_1_2_1_3 or
-      rhel9cis_rule_1_1_2_1_4
+    - rhel9cis_rule_1_1_2_1_1 or rhel9cis_rule_1_1_2_1_2 or rhel9cis_rule_1_1_2_1_3 or rhel9cis_rule_1_1_2_1_4
   tags:
     - level1-server
     - level1-workstation
@@ -79,10 +121,12 @@
     - rule_1.1.2.1.4
     - NIST800-53R5_AC-3
     - NIST800-53R5_MP-2
+  vars:
+    mount_point: "/tmp"
   ansible.builtin.template:
     src: etc/systemd/system/tmp.mount.j2
     dest: /etc/systemd/system/tmp.mount
     owner: root
     group: root
-    mode: '0644'
-  notify: Systemd restart tmp.mount
+    mode: "go-wx"
+  notify: *mount_option_notify