ansible-collection-hardening/roles/os_hardening/tasks/minimize_access.yml

---
# If the find-task throws an error on /usr/bin/X11 like "File system loop detected"
# the other files inside /usr/bin (and all other directories) are
# still getting found and the permissions minimized in the next task.
# This is also the reason why there's ignore_errors: true on the task.
# also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
- name: Find files with write-permissions for group # noqa command-instead-of-shell
  ansible.builtin.shell: find -L {{ item }} -perm /go+w -type f
  with_community.general.flattened:
    - "{{ os_env_user_paths }}"
    - "{{ os_env_extra_user_paths }}"
  register: minimize_access_directories
  ignore_errors: true
  changed_when: false

- name: Minimize access on found files
  ansible.builtin.file:
    path: "{{ item.1 }}"
    mode: go-w
    state: file
  with_subelements:
    - "{{ minimize_access_directories.results }}"
    - stdout_lines

- name: Find shadow files
  ansible.builtin.stat:
    path: "{{ item }}"
  loop:
    - /etc/shadow
    - /etc/gshadow
    - /etc/shadow-
    - /etc/gshadow-
  register: minimize_access_shadow_files

- name: Change shadow ownership to root and mode to 0600 | os-02
  ansible.builtin.file:
    dest: "{{ item.item }}"
    owner: "{{ os_shadow_perms.owner }}"
    group: "{{ os_shadow_perms.group }}"
    mode: "{{ os_shadow_perms.mode }}"
  when: item.stat.exists
  loop: "{{ minimize_access_shadow_files.results }}"

- name: Find passwd files
  ansible.builtin.stat:
    path: "{{ item }}"
  loop:
    - /etc/passwd
    - /etc/group
    - /etc/passwd-
    - /etc/group-
  register: minimize_access_passwd_files

- name: Change passwd ownership to root and mode to 0644 | os-03
  ansible.builtin.file:
    dest: "{{ item.item }}"
    owner: "{{ os_passwd_perms.owner }}"
    group: "{{ os_passwd_perms.group }}"
    mode: "{{ os_passwd_perms.mode }}"
  when: item.stat.exists
  loop: "{{ minimize_access_passwd_files.results }}"

- name: Change su-binary to only be accessible to user and group root
  ansible.builtin.file:
    dest: /bin/su
    owner: root
    group: root
    mode: "0750"
  when: '"change_user" not in os_security_users_allow'

# we have to define this combined variable here, because when defining it
# in the defaults like this:
# proc_mnt_options: rw,nosuid,nodev,noexec,relatime,hidepid={{ hidepid_option }}
# the role argument validator complains about the missing hidepid_option-variable.
# If we define the hidepid_option-variable in the defaults, we cannot
# overwrite it anymore in the vars (for some reason).

- name: Define proc_mnt_options including hidepid_option
  ansible.builtin.set_fact:
    _proc_mnt_options: "{{ proc_mnt_options }},hidepid={{ hidepid_option }}"

- name: Set option hidepid for proc filesystem
  ansible.posix.mount:
    path: /proc
    src: proc
    fstype: proc
    opts: "{{ _proc_mnt_options }}"
    state: mounted

- name: Generate list of current available mounted filesystems on the system
  ansible.builtin.set_fact:
    mountpoints_list: "{{ ansible_mounts | map(attribute='mount') | list }}"

- name: Append special devices list to valid mountpoint list
  ansible.builtin.set_fact:
    mountpoints_list: "{{ mountpoints_list + ['/dev', '/dev/shm', '/run', '/tmp'] }}"

- name: Minimize access for filesystems
  ansible.builtin.include_tasks: minimize_access_fs.yml
  loop_control:
    loop_var: mount
  loop:
    - path: /boot
      src: "{{ os_mnt_boot_src }}"
      fstype: "{{ os_mnt_boot_filesystem }}"
      opts: "{{ os_mnt_boot_options }}"
      enabled: "{{ os_mnt_boot_enabled }}"
      mode: "{{ os_mnt_boot_dir_mode }}"
      group: "{{ os_mnt_boot_group }}"
      owner: "{{ os_mnt_boot_owner }}"
      dump: "{{ os_mnt_boot_dump }}"
      passno: "{{ os_mnt_boot_passno }}"
    - path: /dev
      src: "{{ os_mnt_dev_src }}"
      fstype: "{{ os_mnt_dev_filesystem }}"
      opts: "{{ os_mnt_dev_options }}"
      enabled: "{{ os_mnt_dev_enabled }}"
      mode: "{{ os_mnt_dev_dir_mode }}"
      group: "{{ os_mnt_dev_group }}"
      owner: "{{ os_mnt_dev_owner }}"
      dump: "{{ os_mnt_dev_dump }}"
      passno: "{{ os_mnt_dev_passno }}"
    - path: /dev/shm
      src: "{{ os_mnt_dev_shm_src }}"
      fstype: "{{ os_mnt_dev_shm_filesystem }}"
      opts: "{{ os_mnt_dev_shm_options }}"
      enabled: "{{ os_mnt_dev_shm_enabled }}"
      mode: "{{ os_mnt_dev_shm_dir_mode }}"
      group: "{{ os_mnt_dev_shm_group }}"
      owner: "{{ os_mnt_dev_shm_owner }}"
      dump: "{{ os_mnt_dev_shm_dump }}"
      passno: "{{ os_mnt_dev_shm_passno }}"
    - path: /home
      src: "{{ os_mnt_home_src }}"
      fstype: "{{ os_mnt_home_filesystem }}"
      opts: "{{ os_mnt_home_options }}"
      enabled: "{{ os_mnt_home_enabled }}"
      mode: "{{ os_mnt_home_dir_mode }}"
      group: "{{ os_mnt_home_group }}"
      owner: "{{ os_mnt_home_owner }}"
      dump: "{{ os_mnt_home_dump }}"
      passno: "{{ os_mnt_home_passno }}"
    - path: /run
      src: "{{ os_mnt_run_src }}"
      fstype: "{{ os_mnt_run_filesystem }}"
      opts: "{{ os_mnt_run_options }}"
      enabled: "{{ os_mnt_run_enabled }}"
      mode: "{{ os_mnt_run_dir_mode }}"
      group: "{{ os_mnt_run_group }}"
      owner: "{{ os_mnt_run_owner }}"
      dump: "{{ os_mnt_run_dump }}"
      passno: "{{ os_mnt_run_passno }}"
    - path: /tmp
      src: "{{ os_mnt_tmp_src }}"
      fstype: "{{ os_mnt_tmp_filesystem }}"
      opts: "{{ os_mnt_tmp_options }}"
      enabled: "{{ os_mnt_tmp_enabled }}"
      mode: "{{ os_mnt_tmp_dir_mode }}"
      group: "{{ os_mnt_tmp_group }}"
      owner: "{{ os_mnt_tmp_owner }}"
      dump: "{{ os_mnt_tmp_dump }}"
      passno: "{{ os_mnt_tmp_passno }}"
    - path: /var
      src: "{{ os_mnt_var_src }}"
      fstype: "{{ os_mnt_var_filesystem }}"
      opts: "{{ os_mnt_var_options }}"
      enabled: "{{ os_mnt_var_enabled }}"
      mode: "{{ os_mnt_var_dir_mode }}"
      group: "{{ os_mnt_var_group }}"
      owner: "{{ os_mnt_var_owner }}"
      dump: "{{ os_mnt_var_dump }}"
      passno: "{{ os_mnt_var_passno }}"
    - path: /var/log
      src: "{{ os_mnt_var_log_src }}"
      fstype: "{{ os_mnt_var_log_filesystem }}"
      opts: "{{ os_mnt_var_log_options }}"
      enabled: "{{ os_mnt_var_log_enabled }}"
      mode: "{{ os_mnt_var_log_dir_mode }}"
      group: "{{ os_mnt_var_log_group }}"
      owner: "{{ os_mnt_var_log_owner }}"
      dump: "{{ os_mnt_var_log_dump }}"
      passno: "{{ os_mnt_var_log_passno }}"
    - path: /var/log/audit
      src: "{{ os_mnt_var_log_audit_src }}"
      fstype: "{{ os_mnt_var_log_audit_filesystem }}"
      opts: "{{ os_mnt_var_log_audit_options }}"
      enabled: "{{ os_mnt_var_log_audit_enabled }}"
      mode: "{{ os_mnt_var_log_audit_dir_mode }}"
      group: "{{ os_mnt_var_log_audit_group }}"
      owner: "{{ os_mnt_var_log_audit_owner }}"
      dump: "{{ os_mnt_var_log_audit_dump }}"
      passno: "{{ os_mnt_var_log_audit_passno }}"
    - path: /var/tmp
      src: "{{ os_mnt_var_tmp_src }}"
      fstype: "{{ os_mnt_var_tmp_filesystem }}"
      opts: "{{ os_mnt_var_tmp_options }}"
      enabled: "{{ os_mnt_var_tmp_enabled }}"
      mode: "{{ os_mnt_var_tmp_dir_mode }}"
      group: "{{ os_mnt_var_tmp_group }}"
      owner: "{{ os_mnt_var_tmp_owner }}"
      dump: "{{ os_mnt_var_tmp_dump }}"
      passno: "{{ os_mnt_var_tmp_passno }}"