86 lines
1.5 KiB
YAML
86 lines
1.5 KiB
YAML
|
---
|
||
|
|
- name: Mount /proc with additional options
|
||
|
|
become: true
|
||
|
|
ansible.posix.mount:
|
||
|
|
name: /proc
|
||
|
|
src: none
|
||
|
|
fstype: proc
|
||
|
|
opts: rw,nosuid,nodev,noexec,relatime,hidepid={{ hide_pid | int }},gid={{ process_group }}
|
||
|
|
state: present
|
||
|
|
tags:
|
||
|
|
- mount
|
||
|
|
- proc
|
||
|
|
|
||
|
|
- name: Stat /dev/shm
|
||
|
|
ansible.builtin.stat:
|
||
|
|
path: /dev/shm
|
||
|
|
register: dev_shm
|
||
|
|
tags:
|
||
|
|
- mount
|
||
|
|
- shm
|
||
|
|
|
||
|
|
- name: Mount /dev/shm with noexec
|
||
|
|
become: true
|
||
|
|
ansible.posix.mount:
|
||
|
|
name: /dev/shm
|
||
|
|
src: none
|
||
|
|
fstype: tmpfs
|
||
|
|
opts: rw,nosuid,nodev,noexec
|
||
|
|
state: present
|
||
|
|
when: dev_shm.stat.exists
|
||
|
|
tags:
|
||
|
|
- mount
|
||
|
|
- shm
|
||
|
|
- CCE-80837-8
|
||
|
|
- CCE-80838-6
|
||
|
|
- CCE-80839-4
|
||
|
|
- CIS-UBUNTU2004-1.1.7
|
||
|
|
- CIS-UBUNTU2004-1.1.8
|
||
|
|
- CIS-UBUNTU2004-1.1.9
|
||
|
|
|
||
|
|
- name: Add systemd tmp.mount
|
||
|
|
become: true
|
||
|
|
ansible.builtin.template:
|
||
|
|
src: etc/systemd/tmp.mount.j2
|
||
|
|
dest: /etc/systemd/system/tmp.mount
|
||
|
|
backup: true
|
||
|
|
mode: "0644"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
tags:
|
||
|
|
- mount
|
||
|
|
- tmp
|
||
|
|
- CCE-82139-7
|
||
|
|
- CCE-82140-5
|
||
|
|
- CCE-82623-0
|
||
|
|
|
||
|
|
- name: Stat tmp.mount
|
||
|
|
ansible.builtin.stat:
|
||
|
|
path: /etc/systemd/system/tmp.mount
|
||
|
|
register: tmp_mount
|
||
|
|
tags:
|
||
|
|
- mount
|
||
|
|
- tmp
|
||
|
|
|
||
|
|
- name: Unmask tmp.mount
|
||
|
|
become: true
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: tmp.mount
|
||
|
|
masked: false
|
||
|
|
when: tmp_mount.stat.exists
|
||
|
|
tags:
|
||
|
|
- mount
|
||
|
|
- tmp
|
||
|
|
|
||
|
|
- name: Start tmp.mount
|
||
|
|
become: true
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: tmp.mount
|
||
|
|
daemon_reload: true
|
||
|
|
state: started
|
||
|
|
enabled: true
|
||
|
|
when: tmp_mount.stat.exists
|
||
|
|
tags:
|
||
|
|
- mount
|
||
|
|
- tmp
|