60 lines
1.3 KiB
YAML
60 lines
1.3 KiB
YAML
|
---
|
||
|
|
- name: Disable misc kernel modules
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
dest: /etc/modprobe.d/disablemod.conf
|
||
|
|
line: "install {{ item }} /bin/true"
|
||
|
|
mode: "0644"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
with_items:
|
||
|
|
- "{{ misc_modules_blocklist }}"
|
||
|
|
tags:
|
||
|
|
- modprobe
|
||
|
|
- CCE-80832-9
|
||
|
|
- CCE-82005-0
|
||
|
|
- CCE-82059-7
|
||
|
|
- CIS-UBUNTU2004-1.1.24
|
||
|
|
- M1034
|
||
|
|
- M1038
|
||
|
|
- M1042
|
||
|
|
|
||
|
|
- name: Stat blacklisted kernel modules
|
||
|
|
environment:
|
||
|
|
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||
|
|
ansible.builtin.shell: |
|
||
|
|
set -o pipefail
|
||
|
|
modprobe -c | grep -o '^blacklist .*' | awk '{print $2}'
|
||
|
|
args:
|
||
|
|
executable: /bin/bash
|
||
|
|
changed_when: false
|
||
|
|
failed_when: modprobe_blacklist.rc != 0
|
||
|
|
register: modprobe_blacklist
|
||
|
|
when: block_blacklisted | bool
|
||
|
|
tags:
|
||
|
|
- modprobe
|
||
|
|
- M1034
|
||
|
|
- M1038
|
||
|
|
- M1042
|
||
|
|
|
||
|
|
- name: Block blacklisted kernel modules
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
dest: /etc/modprobe.d/blockblacklisted.conf
|
||
|
|
line: "install {{ item }} /bin/true"
|
||
|
|
mode: "0644"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
with_items:
|
||
|
|
- "{{ modprobe_blacklist.stdout_lines | sort }}"
|
||
|
|
when: block_blacklisted | bool
|
||
|
|
tags:
|
||
|
|
- modprobe
|
||
|
|
- M1034
|
||
|
|
- M1038
|
||
|
|
- M1042
|