forked from ansible-lockdown/RHEL9-CIS
133 lines
3.7 KiB
YAML
133 lines
3.7 KiB
YAML
---
|
|
|
|
- name: "1.6.1.1 | PATCH | Ensure SELinux is installed"
|
|
ansible.builtin.package:
|
|
name: libselinux
|
|
state: present
|
|
when:
|
|
- rhel9cis_rule_1_6_1_1
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.6.1.1
|
|
|
|
- name: "1.6.1.2 | PATCH | Ensure SELinux is not disabled in bootloader configuration"
|
|
ansible.builtin.replace:
|
|
path: /etc/default/grub
|
|
regexp: '{{ item }}'
|
|
replace: ''
|
|
loop:
|
|
- selinux=0
|
|
- enforcing=0
|
|
register: selinux_grub_patch
|
|
ignore_errors: true # noqa ignore-errors
|
|
notify: Grub2cfg
|
|
when:
|
|
- rhel9cis_rule_1_6_1_2
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- scored
|
|
- patch
|
|
- rule_1.6.1.2
|
|
|
|
# State set to enforcing because control 1.6.1.5 requires enforcing to be set
|
|
- name: "1.6.1.3 | PATCH | Ensure SELinux policy is configured"
|
|
ansible.posix.selinux:
|
|
conf: /etc/selinux/config
|
|
policy: "{{ rhel9cis_selinux_pol }}"
|
|
state: "{{ rhel9cis_selinux_enforce }}"
|
|
when:
|
|
- not rhel9cis_selinux_disable
|
|
- rhel9cis_rule_1_6_1_3
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- selinux
|
|
- patch
|
|
- rule_1.6.1.3
|
|
|
|
- name: "1.6.1.4 | PATCH | Ensure the SELinux state is not disabled"
|
|
ansible.posix.selinux:
|
|
conf: /etc/selinux/config
|
|
policy: "{{ rhel9cis_selinux_pol }}"
|
|
state: "{{ rhel9cis_selinux_enforce }}"
|
|
when:
|
|
- not rhel9cis_selinux_disable
|
|
- rhel9cis_rule_1_6_1_4
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- selinux
|
|
- patch
|
|
- rule_1.6.1.4
|
|
|
|
- name: "1.6.1.5 | PATCH | Ensure the SELinux state is enforcing"
|
|
ansible.posix.selinux:
|
|
conf: /etc/selinux/config
|
|
policy: "{{ rhel9cis_selinux_pol }}"
|
|
state: enforcing
|
|
when:
|
|
- not rhel9cis_selinux_disable
|
|
- rhel9cis_selinux_enforce == 'enforcing'
|
|
- rhel9cis_rule_1_6_1_5
|
|
tags:
|
|
- level2-server
|
|
- level2-workstation
|
|
- selinux
|
|
- patch
|
|
- rule_1.6.1.5
|
|
|
|
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist"
|
|
block:
|
|
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Find the unconfined services"
|
|
ansible.builtin.shell: ps -eZ | grep unconfined_service_t | egrep -vw "tr|ps|egrep|bash|awk" | tr ':' ' ' | awk '{ print $NF }'
|
|
register: rhelcis_1_6_1_6_unconf_services
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | Message on unconfined services"
|
|
ansible.builtin.debug:
|
|
msg: "Warning!! You have unconfined services: {{ rhelcis_1_6_1_6_unconf_services.stdout_lines }}"
|
|
when: rhelcis_1_6_1_6_unconf_services.stdout | length > 0
|
|
|
|
- name: "1.6.1.6 | AUDIT | Ensure no unconfined services exist | warning count"
|
|
ansible.builtin.import_tasks:
|
|
file: warning_facts.yaml
|
|
when: rhelcis_1_6_1_6_unconf_services.stdout | length > 0
|
|
vars:
|
|
warn_control_id: '1.6.1.6'
|
|
when:
|
|
- rhel9cis_rule_1_6_1_6
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- audit
|
|
- services
|
|
- rule_1.6.1.6
|
|
|
|
- name: "1.6.1.7 | PATCH | Ensure SETroubleshoot is not installed"
|
|
ansible.builtin.package:
|
|
name: setroubleshoot
|
|
state: absent
|
|
when:
|
|
- rhel9cis_rule_1_6_1_7
|
|
- "'setroubleshoot' in ansible_facts.packages"
|
|
tags:
|
|
- level1-server
|
|
- selinux
|
|
- patch
|
|
- rule_1.6.1.7
|
|
|
|
- name: "1.6.1.8 | PATCH | Ensure the MCS Translation Service (mcstrans) is not installed"
|
|
ansible.builtin.package:
|
|
name: mcstrans
|
|
state: absent
|
|
when:
|
|
- rhel9cis_rule_1_6_1_8
|
|
tags:
|
|
- level1-server
|
|
- level1-workstation
|
|
- patch
|
|
- rule_1.6.1.8
|