89138be4ec
* rewrite system account detection and hardening * resolve failures created when resolving merge conflicts Signed-off-by: Sebastian Gumprich <[email protected]> * add tests for shell removal tasks Signed-off-by: Sebastian Gumprich <[email protected]> * Update molecule/os_hardening/prepare.yml Signed-off-by: Martin Schurz <[email protected]> * split tasks for locking and setting shell Signed-off-by: Martin Schurz <[email protected]> * fix some more linting Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Sebastian Gumprich <[email protected]> Signed-off-by: Martin Schurz <[email protected]> Co-authored-by: donestefan <[email protected]> Co-authored-by: schurzi <[email protected]>
37 lines
1.4 KiB
YAML
37 lines
1.4 KiB
YAML
---
|
|
- name: "Configure hardened options for mount {{ mount.path }}"
|
|
ansible.posix.mount:
|
|
path: "{{ mount.path }}"
|
|
src: "{{ mount.src | default(mountinfo.device, true) }}"
|
|
fstype: "{{ mount.fstype | default(mountinfo.fstype, true) }}"
|
|
opts: "{{ mount.opts }}"
|
|
dump: "{{ mount.dump | default('1' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
|
|
passno: "{{ mount.passno | default('2' if mount.fstype | default(mountinfo.fstype, true) in ['ext3', 'ext4'] else '0', true) }}"
|
|
state: present
|
|
register: mountpoint
|
|
when:
|
|
- mount.enabled | bool
|
|
- mount.path in mountpoints_list
|
|
vars:
|
|
mountinfo: "{{ ansible_mounts | selectattr('mount', 'equalto', mount.path) | list | first | default(None) }}"
|
|
notify: Remount filesystems
|
|
|
|
- name: "Check for existence of mount {{ mount.path }}"
|
|
ansible.builtin.stat:
|
|
path: "{{ mount.path }}"
|
|
register: mountpoint_exists
|
|
|
|
- name: "Harden permissions for directory of mount {{ mount.path }}"
|
|
ansible.builtin.file:
|
|
dest: "{{ mount.path }}"
|
|
owner: "{{ mount.owner }}"
|
|
group: "{{ mount.group }}"
|
|
mode: "{{ mount.mode }}"
|
|
when:
|
|
- mountpoint_exists.stat.exists | bool
|
|
|
|
- name: "Register changed mountpoints"
|
|
ansible.builtin.set_fact:
|
|
mountpoints_changed: "{{ mountpoints_changed | default([]) + [mount.path] }}"
|
|
when: mountpoint.changed # noqa no-handler
|