28 lines
623 B
YAML
28 lines
623 B
YAML
|
---
|
||
|
|
- name: Disable file system kernel modules
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
dest: /etc/modprobe.d/disablefs.conf
|
||
|
|
line: "install {{ item }} /bin/true"
|
||
|
|
mode: "0644"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
with_items:
|
||
|
|
- "{{ fs_modules_blocklist }}"
|
||
|
|
tags:
|
||
|
|
- modprobe
|
||
|
|
- CCE-80835-2
|
||
|
|
- CCE-81031-7
|
||
|
|
- CIS-UBUNTU2004-1.1.1.1
|
||
|
|
- CIS-UBUNTU2004-1.1.1.2
|
||
|
|
- CIS-UBUNTU2004-1.1.1.3
|
||
|
|
- CIS-UBUNTU2004-1.1.1.4
|
||
|
|
- CIS-UBUNTU2004-1.1.1.5
|
||
|
|
- CIS-UBUNTU2004-1.1.1.5
|
||
|
|
- CIS-UBUNTU2004-1.1.1.6
|
||
|
|
- CIS-UBUNTU2004-1.1.1.7
|
||
|
|
- M1038
|
||
|
|
- M1042
|