add more tests to the os-hardening vm tests

Signed-off-by: Sebastian Gumprich <[email protected]>

molecule/os_hardening_vm/converge.yml

@@ -10,7 +10,7 @@
     - devsec.hardening
   tasks:
     - name: override for arch
-      set_fact: 
+      set_fact:
         os_mnt_boot_enabled: false
       when: ansible_facts.os_family == 'Archlinux'
     - include_role:
@@ -21,3 +21,14 @@
     os_yum_repo_file_whitelist: ['foo.repo']
     os_mnt_boot_enabled: true
     os_mnt_boot_src: "/dev/vda1"
+    os_mnt_var_log_audit_enabled: true
+    os_auditd_enabled: true
+    os_mnt_boot_enabled: true
+    os_mnt_dev_enabled: true
+    os_mnt_dev_shm_enabled: true
+    os_mnt_home_enabled: true
+    os_mnt_run_enabled: true
+    os_mnt_var_enabled: true
+    os_mnt_var_log_enabled: true
+    os_mnt_var_log_audit_enabled: true
+    os_mnt_var_tmp_enabled: true

roles/os_hardening/tasks/minimize_access.yml

@@ -208,6 +208,11 @@
     group: 'root'
     mode: '{{ os_mnt_var_log_dir_mode }}'
 
+- name: Check if /var/log/audit exists
+  stat:
+    path: /var/log/audit
+  register: var_log_audit_exists
+
 - name: Mount /var/log/audit with hardened options
   mount:
     path: /var/log/audit
@@ -216,7 +221,10 @@
     opts: '{{ os_mnt_var_log_audit_options }}'
     state: present
   register: varlogauditmount
-  when: os_mnt_var_log_audit_enabled | bool
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
 
 - name: Harden permissions for /var/log/audit directory
   file:
@@ -224,6 +232,10 @@
     owner: 'root'
     group: 'root'
     mode: '{{ os_mnt_var_log_audit_dir_mode }}'
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
 
 - name: Mount /var/tmp with hardened options
   mount: