---

- name: "1.8.1 | PATCH | Ensure GNOME Display Manager is removed"
  ansible.builtin.package:
      name: gdm
      state: absent
  when:
      - rhel9cis_rule_1_8_1
      - "'gdm' in ansible_facts.packages"
  tags:
      - level2-server
      - patch
      - gui
      - gdm
      - rule_1.8.1

- name: "1.8.2 | PATCH | Ensure GDM login banner is configured"
  ansible.builtin.lineinfile:
      path: "{{ item.file }}"
      regexp: "{{ item.regexp }}"
      line: "{{ item.line }}"
      state: present
      create: true
      owner: root
      group: root
      mode: 0644
  notify: Reload dconf
  with_items:
      - { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
      - { file: '/etc/dconf/profile/gdm', regexp: 'system-db', line: 'system-db:gdm' }
      - { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults' }
      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-enable', line: 'banner-message-enable=true' }
      - { file: '/etc/dconf/db/gdm.d/01-banner-message', regexp: 'banner-message-text', line: "banner-message-text='{{ rhel9cis_warning_banner }}' " }
  when:
      - rhel9cis_rule_1_8_2
      - rhel9cis_gui
  tags:
      - level1-server
      - level1-workstation
      - patch
      - gui
      - gdm
      - rule_1.8.2

- name: "1.8.3 | PATCH | Ensure GDM disable-user-list option is enabled"
  ansible.builtin.lineinfile:
      path: "{{ item.file }}"
      regexp: "{{ item.regexp }}"
      line: "{{ item.line }}"
      create: true
      owner: root
      group: root
      mode: 0644
  notify: Reload dconf
  with_items:
      - { file: '/etc/dconf/profile/gdm', regexp: 'user-db', line: 'user-db:user' }
      - { file: '/etc/dconf/profile/gdm', regexp: 'system-db', line: 'system-db:gdm' }
      - { file: '/etc/dconf/profile/gdm', regexp: 'file-db', line: 'file-db:/usr/share/gdm/greeter-dconf-defaults'}
      - { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: '\[org\/gnome\/login-screen\]', line: '[org/gnome/login-screen]' }
      - { file: '/etc/dconf/db/gdm.d/00-login-screen', regexp: 'disable-user-list=', line: 'disable-user-list=true' }
  when:
      - rhel9cis_rule_1_8_3
      - rhel9cis_gui
  tags:
      - level1-server
      - level1-workstation
      - patch
      - gui
      - rule_1.8.3

- name: "1.8.6 | PATCH | Ensure automatic mounting of removable media is disabled"
  ansible.builtin.lineinfile:
      path: /etc/dconf/db/local.d/00-media-automount
      regexp: "{{ item.regex }}"
      line: "{{ item.line }}"
      create: true
      owner: root
      group: root
      mode: 0644
  notify: Reload dconf
  with_items:
      - { regex: '\[org\/gnome\/desktop\/media-handling\]', line: '[org/gnome/desktop/media-handling]' }
      - { regex: 'automount=', line: 'automount=false' }
      - { regex: 'automount-open=', line: 'automount-open=false'}
  when:
      - rhel9cis_rule_1_8_6
      - rhel9cis_gui
  tags:
      - level1-server
      - level2-workstation
      - patch
      - gui
      - rule_1.8.6


- name: "1.8.10 | PATCH | Ensure XDMCP is not enabled"
  ansible.builtin.lineinfile:
      path: /etc/gdm/custom.conf
      regexp: 'Enable=true'
      state: absent
  when:
      - rhel9cis_rule_1_8_10
      - rhel9cis_gui
  tags:
      - level1-server
      - level1-workstation
      - patch
      - gui
      - rule_1.8.4