---

- name: "4.1.3.1 | PATCH | Ensure changes to system administration scope (sudoers) is collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_1
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.1

- name: "4.1.3.2 | PATCH | Ensure actions as another user are always logged"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_2
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.2

- name: "4.1.3.3 | PATCH | Ensure events that modify the sudo log file are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_3
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.3

- name: "4.1.3.4 | PATCH | Ensure events that modify date and time information are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_4
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.4

- name: "4.1.3.5 | PATCH | Ensure events that modify the system's network environment are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_5
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.5

- name: "4.1.3.6 | PATCH | Ensure use of privileged commands is collected"
  block:
      - name: "4.1.3.6 | PATCH | Ensure use of privileged commands is collected"
        shell: for i in  $(df | grep '^/dev' | awk '{ print $NF }'); do find $i -xdev -type f -perm -4000 -o -type f -perm -2000 2>/dev/null; done
        changed_when: false
        failed_when: false
        check_mode: no
        register: priv_procs

      - name: "4.1.3.6 | PATCH | Ensure use of privileged commands is collected"
        debug:
            msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
        changed_when: true
        notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_6
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.6

- name: "4.1.3.7 | PATCH | Ensure unsuccessful unauthorized file access attempts are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_7
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3_7

- name: "4.1.3.8 | PATCH | Ensure events that modify user/group information are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_8
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.8

- name: "4.1.3.9 | PATCH | Ensure discretionary access control permission modification events are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_9
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.9

- name: "4.1.3.10 | PATCH | Ensure successful file system mounts are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_10
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.10

- name: "4.1.3.11 | PATCH | Ensure session initiation information is collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_11
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.11

- name: "4.1.3.12 | PATCH | Ensure login and logout events are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_12
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.12

- name: "4.1.3.13 | PATCH | Ensure file deletion events by users are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_13
  tags:
      - level2-server
      - level2-workstation
      - auditd
      - patch
      - rule_4.1.3.13

- name: "4.1.3.14 | PATCH | Ensure events that modify the system's Mandatory Access Controls are collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_14
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.14

- name: "4.1.3.15 | PATCH | Ensure successful and unsuccessful attempts to use the chcon command are recorded"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_15
  tags:
      - level2-server
      - level2- workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.15

- name: "4.1.3.16 | PATCH | Ensure successful and unsuccessful attempts to use the setfacl command are recorded"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_16
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.16

- name: "4.1.3.17 | PATCH | Ensure successful and unsuccessful attempts to use the chacl command are recorded"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_17
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.17

- name: "4.1.3.18 | PATCH | Ensure successful and unsuccessful attempts to use the usermod command are recorded"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_18
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.18

- name: "4.1.3.19 | PATCH | Ensure kernel module loading and unloading is collected"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_19
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.3.19

- name: "4.1.3.20 | PATCH | Ensure the audit configuration is immutable"
  debug:
      msg: "Control being set via Handler 'update auditd' which writes to /etc/audit.d/99_auditd.rules"
  changed_when: true
  notify: update auditd
  when:
      - rhel9cis_rule_4_1_3_20
  tags:
      - level2-server
      - level2-workstation
      - automated
      - patch
      - auditd
      - rule_4.1.20

- name: "4.1.3.21 | AUDIT | Ensure the running and on disk configuration is the same"
  debug:
      msg:
          - "Please run augenrules --load if you suspect there is a configuration that is not active"
  when:
      - rhel9cis_rule_4_1_3_21
  tags:
      - level2-server
      - level2-workstation
      - manual
      - patch
      - auditd
      - rule_4.1.3.21