RHEL9-CIS/tasks/section_1/cis_1.4.x.yml

---

- name: "1.4.1 | PATCH | Ensure bootloader password is set"
  ansible.builtin.copy:
      dest: /boot/grub2/user.cfg
      content: "GRUB2_PASSWORD={{ rhel9cis_bootloader_password_hash }}"  # noqa template-instead-of-copy
      owner: root
      group: root
      mode: 0600
  notify: grub2cfg
  when:
      - rhel9cis_set_boot_pass
      - rhel9cis_rule_1_4_1
  tags:
      - level1-server
      - level1-workstation
      - grub
      - patch
      - rule_1.4.1

- name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured"
  block:
      - name: "1.4.2 | PATCH | Ensure permissions on bootloader config are configured"
        ansible.builtin.file:
            path: /boot/grub2/grub.cfg
            owner: root
            group: root
            mode: 0600
        loop:
            - grub.cfg
            - grubenv
            - user.cfg

  when:
      - rhel9cis_rule_1_4_2
  tags:
      - level1-server
      - level1-workstation
      - grub
      - patch
      - rule_1.4.2