use fqn for with_flattened

Signed-off-by: Sebastian Gumprich <[email protected]>

roles/os_hardening/tasks/minimize_access.yml

@@ -4,16 +4,17 @@
 # still getting found and the permissions minimized in the next task.
 # This is also the reason why there's ignore_errors: true on the task.
 # also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
+
 - name: Find files with write-permissions for group
   shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
-  with_flattened:
+  loop:
     - '/usr/local/sbin'
     - '/usr/local/bin'
     - '/usr/sbin'
     - '/usr/bin'
     - '/sbin'
     - '/bin'
-    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
+    - "{{ os_env_extra_user_paths | flatten }}"  # noqa deprecated-bare-vars
   register: minimize_access_directories
   ignore_errors: true
   changed_when: false
@@ -208,6 +209,11 @@
     group: 'root'
     mode: '{{ os_mnt_var_log_dir_mode }}'
 
+- name: Check if /var/log/audit exists
+  stat:
+    path: /var/log/audit
+  register: var_log_audit_exists
+
 - name: Mount /var/log/audit with hardened options
   mount:
     path: /var/log/audit
@@ -216,7 +222,10 @@
     opts: '{{ os_mnt_var_log_audit_options }}'
     state: present
   register: varlogauditmount
-  when: os_mnt_var_log_audit_enabled | bool
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
 
 - name: Harden permissions for /var/log/audit directory
   file:
@@ -224,6 +233,10 @@
     owner: 'root'
     group: 'root'
     mode: '{{ os_mnt_var_log_audit_dir_mode }}'
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
 
 - name: Mount /var/tmp with hardened options
   mount:

roles/os_hardening/tasks/rhosts.yml

@@ -9,7 +9,7 @@
   file:
     dest: '~{{ item }}/.rhosts'
     state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
+  loop: '{{ users_accounts.stdout_lines | default([]) | flatten }}'
 
 - name: Delete hosts.equiv from system | os-01
   file:
@@ -20,4 +20,4 @@
   file:
     dest: '~{{ item }}/.netrc'
     state: 'absent'
-  with_flattened: '{{ users_accounts.stdout_lines | default([]) }}'
+  loop: '{{ users_accounts.stdout_lines | default([]) | flatten }}'

roles/os_hardening/tasks/suid_sgid.yml

@@ -6,9 +6,9 @@
     state: 'file'
     follow: 'yes'
   failed_when: false
-  with_flattened:
-    - '{{ os_security_suid_sgid_system_blacklist }}'
-    - '{{ os_security_suid_sgid_blacklist }}'
+  loop:
+    - '{{ os_security_suid_sgid_system_blacklist | flatten }}'
+    - '{{ os_security_suid_sgid_blacklist | flatten }}'
 
 - name: Find binaries with suid/sgid set | os-06
   shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
@@ -27,6 +27,6 @@
     mode: 'a-s'
     state: 'file'
     follow: 'yes'
-  with_flattened:
-    - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}'
+  loop:
+    - '{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) | flatten }}'
   when: os_security_suid_sgid_remove_from_unknown | bool

roles/os_hardening/tasks/user_accounts.yml

@@ -43,8 +43,8 @@
     shell: '{{ os_nologin_shell_path }}'
     password: '*'
     createhome: false
-  with_flattened:
-    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list }}'
+  loop:
+    - '{{ sys_accs_cond | default([]) | difference(os_ignore_users) | list | flatten }}'
 
 - name: get all home directories in /home, but skip ignored users
   find: