95 lines
2.3 KiB
YAML
95 lines
2.3 KiB
YAML
|
---
|
||
|
|
- name: Create /boot/grub directory if efi boot
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: /boot/grub
|
||
|
|
state: directory
|
||
|
|
mode: "0755"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
when: booted_with_efi | bool
|
||
|
|
tags:
|
||
|
|
- grub
|
||
|
|
|
||
|
|
- name: Run all notified handlers
|
||
|
|
ansible.builtin.meta: flush_handlers
|
||
|
|
|
||
|
|
- name: Stat RedHat auditd GRUB settings
|
||
|
|
become: true
|
||
|
|
ansible.builtin.shell:
|
||
|
|
cmd: |
|
||
|
|
set -o pipefail
|
||
|
|
grubby --info="/boot/vmlinuz-$(uname -r)" | grep "^args.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"
|
||
|
|
changed_when: false
|
||
|
|
failed_when: false
|
||
|
|
args:
|
||
|
|
executable: /bin/bash
|
||
|
|
register: audit_grubenv
|
||
|
|
when: ansible_os_family == "RedHat"
|
||
|
|
ignore_errors: true
|
||
|
|
tags:
|
||
|
|
- auditd
|
||
|
|
- grub
|
||
|
|
|
||
|
|
- name: Update grub2 if missing GRUB settings
|
||
|
|
become: true
|
||
|
|
ansible.builtin.command:
|
||
|
|
cmd: grub2-mkconfig
|
||
|
|
register: update_grub_redhat
|
||
|
|
changed_when: update_grub_redhat.rc != 0
|
||
|
|
failed_when: update_grub_redhat.rc != 0
|
||
|
|
when: ansible_os_family == "RedHat" and audit_grubenv.rc != 0
|
||
|
|
tags:
|
||
|
|
- auditd
|
||
|
|
- grub
|
||
|
|
|
||
|
|
- name: Stat Debian auditd GRUB settings
|
||
|
|
become: true
|
||
|
|
ansible.builtin.shell: grep "linux.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}" /boot/grub/grub.cfg
|
||
|
|
changed_when: audit_grub_cfg.rc != 0
|
||
|
|
failed_when: audit_grub_cfg.rc != 0
|
||
|
|
register: audit_grub_cfg
|
||
|
|
ignore_errors: true
|
||
|
|
when: ansible_os_family == "Debian"
|
||
|
|
tags:
|
||
|
|
- auditd
|
||
|
|
- grub
|
||
|
|
|
||
|
|
- name: Update GRUB if settings are missing
|
||
|
|
become: true
|
||
|
|
ansible.builtin.command:
|
||
|
|
cmd: update-grub
|
||
|
|
register: update_grub_debian
|
||
|
|
changed_when: update_grub_debian.rc != 0
|
||
|
|
failed_when: update_grub_debian.rc != 0
|
||
|
|
when: ansible_os_family == "Debian" and audit_grub_cfg.rc != 0
|
||
|
|
tags:
|
||
|
|
- auditd
|
||
|
|
- grub
|
||
|
|
|
||
|
|
- name: Find GRUB config files
|
||
|
|
become: true
|
||
|
|
ansible.builtin.find:
|
||
|
|
paths: /boot
|
||
|
|
patterns: "*.cfg,grubenv"
|
||
|
|
recurse: true
|
||
|
|
register: grub_cfg
|
||
|
|
tags:
|
||
|
|
- grub
|
||
|
|
- CIS-UBUNTU2004-1.4.3
|
||
|
|
|
||
|
|
- name: Set GRUB config permissions
|
||
|
|
become: true
|
||
|
|
ansible.builtin.file:
|
||
|
|
path: "{{ item.path }}"
|
||
|
|
mode: "0400"
|
||
|
|
when: item.mode | int > 400
|
||
|
|
changed_when: false
|
||
|
|
with_items:
|
||
|
|
- "{{ grub_cfg.files | reject('search', '/boot/efi/EFI/ubuntu/grub.cfg') | list }}"
|
||
|
|
loop_control:
|
||
|
|
label: "{{ item.path }}"
|
||
|
|
tags:
|
||
|
|
- grub
|
||
|
|
- CIS-UBUNTU2004-1.4.3
|