ansible-collection-hardening/roles/os_hardening/tasks/minimize_access.yml

---
# If the find-task throws an error on /usr/bin/X11 like "File system loop detected"
# the other files inside /usr/bin (and all other directories) are
# still getting found and the permissions minimized in the next task.
# This is also the reason why there's ignore_errors: true on the task.
# also see: https://github.com/dev-sec/ansible-os-hardening/issues/219
- name: Find files with write-permissions for group
  shell: "find -L {{ item }} -perm /go+w -type f"  # noqa command-instead-of-shell
  with_flattened:
    - '/usr/local/sbin'
    - '/usr/local/bin'
    - '/usr/sbin'
    - '/usr/bin'
    - '/sbin'
    - '/bin'
    - "{{ os_env_extra_user_paths }}"  # noqa deprecated-bare-vars
  register: minimize_access_directories
  ignore_errors: true
  changed_when: false

- name: Minimize access on found files
  file:
    path: '{{ item.1 }}'
    mode: 'go-w'
    state: file
  with_subelements:
    - "{{ minimize_access_directories.results }}"
    - stdout_lines

- name: Find shadow files
  stat:
    path: "{{ item }}"
  loop:
    - '/etc/shadow'
    - '/etc/gshadow'
    - '/etc/shadow-'
    - '/etc/gshadow-'
  register: minimize_access_shadow_files

- name: Change shadow ownership to root and mode to 0600 | os-02
  file:
    dest: "{{ item.item }}"
    owner: '{{ os_shadow_perms.owner }}'
    group: '{{ os_shadow_perms.group }}'
    mode: '{{ os_shadow_perms.mode }}'
  when: item.stat.exists
  loop: "{{ minimize_access_shadow_files.results }}"

- name: Find passwd files
  stat:
    path: "{{ item }}"
  loop:
    - '/etc/passwd'
    - '/etc/group'
    - '/etc/passwd-'
    - '/etc/group-'
  register: minimize_access_passwd_files

- name: Change passwd ownership to root and mode to 0644 | os-03
  file:
    dest: "{{ item.item }}"
    owner: '{{ os_passwd_perms.owner }}'
    group: '{{ os_passwd_perms.group }}'
    mode: '{{ os_passwd_perms.mode }}'
  when: item.stat.exists
  loop: "{{ minimize_access_passwd_files.results }}"

- name: Change su-binary to only be accessible to user and group root
  file:
    dest: '/bin/su'
    owner: 'root'
    group: 'root'
    mode: '0750'
  when: '"change_user" not in os_security_users_allow'

- name: Set option hidepid for proc filesystem
  mount:
    path: /proc
    src: proc
    fstype: proc
    opts: '{{ proc_mnt_options }}'
    state: mounted

- name: Check if boot exists
  stat:
    path: /boot
  register: boot_exists

- name: Mount /boot with hardened options
  mount:
    path: /boot
    src: '{{ os_mnt_boot_src }}'
    fstype: '{{ os_mnt_boot_filesystem }}'
    opts: '{{ os_mnt_boot_options }}'
    state: present
  register: bootmount
  when:
    - os_mnt_boot_enabled | bool
    - boot_exists.stat.exists | bool

- name: Harden permissions for /boot directory
  file:
    dest: /boot
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_boot_dir_mode }}'
  when:  boot_exists.stat.exists | bool

- name: Mount /dev with hardened options
  mount:
    path: /dev
    src: '{{ os_mnt_dev_src }}'
    fstype: '{{ os_mnt_dev_filesystem }}'
    opts: '{{ os_mnt_dev_options }}'
    state: present
  register: devmount
  when: os_mnt_dev_enabled | bool

- name: Harden permissions for /dev directory
  file:
    dest: /dev
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_dev_dir_mode }}'

- name: Mount /dev/shm with hardened options
  mount:
    path: /dev/shm
    src: '{{ os_mnt_dev_shm_src }}'
    fstype: '{{ os_mnt_dev_shm_filesystem }}'
    opts: '{{ os_mnt_dev_shm_options }}'
    state: present
  register: devshmmount
  when: os_mnt_dev_shm_enabled | bool

- name: Harden permissions for /dev/shm directory
  file:
    dest: /dev/shm
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_dev_shm_dir_mode }}'

- name: Mount /home with hardened options
  mount:
    path: /home
    src: '{{ os_mnt_home_src }}'
    fstype: '{{ os_mnt_home_filesystem }}'
    opts: '{{ os_mnt_home_options }}'
    state: present
  register: homemount
  when: os_mnt_home_enabled | bool

- name: Harden permissions for /home directory
  file:
    dest: /home
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_home_dir_mode }}'

- name: Mount /run with hardened options
  mount:
    path: /run
    src: '{{ os_mnt_run_src }}'
    fstype: '{{ os_mnt_run_filesystem }}'
    opts: '{{ os_mnt_run_options }}'
    state: present
  register: runmount
  when: os_mnt_run_enabled | bool

- name: Harden permissions for /run directory
  file:
    dest: /run
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_run_dir_mode }}'

- name: Mount /var with hardened options
  mount:
    path: /var
    src: '{{ os_mnt_var_src }}'
    fstype: '{{ os_mnt_var_filesystem }}'
    opts: '{{ os_mnt_var_options }}'
    state: present
  register: varmount
  when: os_mnt_var_enabled | bool

- name: Harden permissions for /var directory
  file:
    dest: /var
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_var_dir_mode }}'

- name: Mount /var/log with hardened options
  mount:
    path: /var/log
    src: '{{ os_mnt_var_log_src }}'
    fstype: '{{ os_mnt_var_log_filesystem }}'
    opts: '{{ os_mnt_var_log_options }}'
    state: present
  register: varlogmount
  when: os_mnt_var_log_enabled | bool

- name: Harden permissions for /var/log directory
  file:
    dest: /var/log
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_var_log_dir_mode }}'

- name: Mount /var/log/audit with hardened options
  mount:
    path: /var/log/audit
    src: '{{ os_mnt_var_log_audit_src }}'
    fstype: '{{ os_mnt_var_log_audit_filesystem }}'
    opts: '{{ os_mnt_var_log_audit_options }}'
    state: present
  register: varlogauditmount
  when: os_mnt_var_log_audit_enabled | bool

- name: Harden permissions for /var/log/audit directory
  file:
    dest: /var/log/audit
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_var_log_audit_dir_mode }}'

- name: Mount /var/tmp with hardened options
  mount:
    path: /var/tmp
    src: '{{ os_mnt_var_tmp_src }}'
    fstype: '{{ os_mnt_var_tmp_filesystem }}'
    opts: '{{ os_mnt_var_tmp_options }}'
    state: present
  register: vartmpmount
  when: os_mnt_var_tmp_enabled | bool

- name: Harden permissions for /var/tmp directory
  file:
    dest: /var/tmp
    owner: 'root'
    group: 'root'
    mode: '{{ os_mnt_var_tmp_dir_mode }}'

- name: remount all changed mountpoints
  mount:
    path: "{{ item.path }}"
    src: "{{ item.src }}"
    fstype: "{{ item.fstype }}"
    opts: "{{ item.opts }}"
    state: remounted
  when: item.when | bool
  loop:
    - { path: '/boot', src: '{{ os_mnt_boot_src }}', fstype: '{{ os_mnt_boot_filesystem }}', opts: '{{ os_mnt_boot_options }}', when: "{{ bootmount.changed }}" }
    - { path: '/dev', src: '{{ os_mnt_dev_src }}', fstype: '{{ os_mnt_dev_filesystem }}', opts: '{{ os_mnt_dev_options }}', when: "{{ devmount.changed }}" }
    - { path: '/dev/shm', src: '{{ os_mnt_dev_shm_src }}', fstype: '{{ os_mnt_dev_shm_filesystem }}', opts: '{{ os_mnt_dev_shm_options }}', when: "{{ devshmmount.changed }}" }
    - { path: '/home', src: '{{ os_mnt_home_src }}', fstype: '{{ os_mnt_home_filesystem }}', opts: '{{ os_mnt_home_options }}', when: "{{ homemount.changed }}" }
    - { path: '/run', src: '{{ os_mnt_run_src }}', fstype: '{{ os_mnt_run_filesystem }}', opts: '{{ os_mnt_run_options }}', when: "{{ runmount.changed }}" }
    - { path: '/var', src: '{{ os_mnt_var_src }}', fstype: '{{ os_mnt_var_filesystem }}', opts: '{{ os_mnt_var_options }}', when: "{{ varmount.changed }}" }
    - { path: '/var/log', src: '{{ os_mnt_var_log_src }}', fstype: '{{ os_mnt_var_log_filesystem }}', opts: '{{ os_mnt_var_log_options }}', when: "{{ varlogmount.changed }}" }
    - { path: '/var/log/audit', src: '{{ os_mnt_var_log_audit_src }}', fstype: '{{ os_mnt_var_log_audit_filesystem }}', opts: '{{ os_mnt_var_log_audit_options }}', when: "{{ varlogauditmount.changed }}" }
    - { path: '/var/tmp', src: '{{ os_mnt_var_tmp_src }}', fstype: '{{ os_mnt_var_tmp_filesystem }}', opts: '{{ os_mnt_var_tmp_options }}', when: "{{ vartmpmount.changed }}" }