forked from ansible-lockdown/RHEL9-CIS
66 lines
1.9 KiB
YAML
66 lines
1.9 KiB
YAML
---
|
|
|
|
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
|
|
when: rhel9cis_rule_1_5_1
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- sysctl
|
|
- rule_1.5.1
|
|
- NIST800-53R5_CM-6
|
|
- NIST800-53R5_CM-6.1
|
|
block:
|
|
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
|
|
ansible.builtin.set_fact:
|
|
rhel9cis_sysctl_update: true
|
|
|
|
- name: "1.5.1 | PATCH | Ensure address space layout randomization (ASLR) is enabled"
|
|
ansible.builtin.debug:
|
|
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-kernel_sysctl.conf"
|
|
|
|
- name: "1.5.2 | PATCH | Ensure ptrace_scope is restricted"
|
|
when: rhel9cis_rule_1_5_2
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- sysctl
|
|
- rule_1.5.2
|
|
block:
|
|
- name: "1.5.2 | PATCH | Ensure ptrace_scope is restricted"
|
|
ansible.builtin.set_fact:
|
|
rhel9cis_sysctl_update: true
|
|
|
|
- name: "1.5.2 | PATCH | Ensure ptrace_scope is restricted"
|
|
ansible.builtin.debug:
|
|
msg: "Control being set via Handler 'update sysctl' which writes to /etc/sysctl.d/60-kernel_sysctl.conf"
|
|
|
|
- name: "1.5.3 | PATCH | Ensure core dump backtraces are disabled"
|
|
when: rhel9cis_rule_1_5_3
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- sysctl
|
|
- rule_1.5.3
|
|
- NIST800-53R5_CM-6b
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/systemd/coredump.conf
|
|
regexp: '(?#)^ProcessSizeMax\s*=\s*.*[1-9].*$'
|
|
line: 'ProcessSizeMax=0'
|
|
|
|
- name: "1.5.4 | PATCH | Ensure core dump storage is disabled"
|
|
when:
|
|
- rhel9cis_rule_1_5_4
|
|
- prelim_systemd_coredump.stat.exists
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.5.4
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/systemd/coredump.conf
|
|
regexp: '^Storage\s*=\s*(?!none).*'
|
|
line: 'Storage=none'
|
|
notify: Systemd daemon reload
|