---

# Skips if mount is absent
- name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition"
  when:
    - rhel9cis_rule_1_1_2_2_1
  tags:
    - level1-server
    - level1-workstation
    - audit
    - mounts
    - rule_1.1.2.2.1
    - NIST800-53R5_CM-7
  vars:
    warn_control_id: '1.1.2.2.1'
  block:
    - name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition | check exists"
      ansible.builtin.shell: mount -l | grep -w /dev/shm
      changed_when: false
      register: discovered_dev_shm_mount_check

    - name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition"
      when: discovered_dev_shm_mount_check.rc == 1
      block:
        - name: "1.1.2.2.1 | AUDIT | Ensure /dev/shm is a separate partition | Absent"
          ansible.builtin.debug:
            msg: "Warning!! {{ required_mount }} doesn't exist. This is a manual task"

        - name: "1.1.2.2.1 | AUDIT | Ensure separate partition exists for /home | Present"
          ansible.builtin.import_tasks:
            file: warning_facts.yml

- name: |
    "1.1.2.2.2 | PATCH | Ensure nodev option set on /dev/shm partition
     1.1.2.2.3 | PATCH | Ensure nosuid option set on /dev/shm partition
     1.1.2.2.4 | PATCH | Ensure noexec option set on /dev/shm partition"
  when:
    - rhel9cis_rule_1_1_2_2_2 or
      rhel9cis_rule_1_1_2_2_3 or
      rhel9cis_rule_1_1_2_2_4
  tags:
    - level1-server
    - level1-workstation
    - patch
    - mounts
    - rule_1.1.2.2.2
    - rule_1.1.2.2.3
    - rule_1.1.2.2.4
    - NIST800-53R5_AC-3
    - NIST800-53R5_MP-2
  ansible.posix.mount:
    name: /dev/shm
    src: tmpfs
    fstype: tmpfs
    state: mounted
    opts: defaults,{% if rhel9cis_rule_1_1_2_2_2 %}nodev,{% endif %}{% if rhel9cis_rule_1_1_2_2_3 %}nosuid,{% endif %}{% if rhel9cis_rule_1_1_2_2_4 %}noexec{% endif %}
  notify: Change_requires_reboot