68 lines
1.7 KiB
YAML
68 lines
1.7 KiB
YAML
|
---
|
||
|
|
- name: Set Debian family AppArmor grub cmdline
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: 'GRUB_CMDLINE_LINUX="$GRUB_CMDLINE_LINUX apparmor=1 security=apparmor"'
|
||
|
|
dest: /etc/default/grub.d/99-hardening-apparmor.cfg
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
mode: "0640"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
when: ansible_os_family == "Debian"
|
||
|
|
notify:
|
||
|
|
- Update GRUB
|
||
|
|
tags:
|
||
|
|
- apparmor
|
||
|
|
- CIS-UBUNTU2004-1.6.1.2
|
||
|
|
|
||
|
|
- name: Configure pam_apparmor
|
||
|
|
become: true
|
||
|
|
ansible.builtin.lineinfile:
|
||
|
|
line: "session optional pam_apparmor.so order=user,group,default"
|
||
|
|
dest: /etc/pam.d/apparmor
|
||
|
|
state: present
|
||
|
|
create: true
|
||
|
|
mode: "0640"
|
||
|
|
owner: root
|
||
|
|
group: root
|
||
|
|
when: ansible_os_family == "Debian"
|
||
|
|
notify:
|
||
|
|
- Update GRUB
|
||
|
|
tags:
|
||
|
|
- apparmor
|
||
|
|
|
||
|
|
- name: Get AppArmor status
|
||
|
|
become: true
|
||
|
|
environment:
|
||
|
|
PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
|
||
|
|
ansible.builtin.command: aa-status --complaining
|
||
|
|
register: get_apparmor_complaining
|
||
|
|
changed_when: get_apparmor_complaining.stdout != "0"
|
||
|
|
when: ansible_os_family == "Debian"
|
||
|
|
tags:
|
||
|
|
- apparmor
|
||
|
|
|
||
|
|
- name: Enforce AppArmor profiles
|
||
|
|
become: true
|
||
|
|
ansible.builtin.command:
|
||
|
|
cmd: find /etc/apparmor.d/ -maxdepth 1 -type f -exec aa-enforce {} \;
|
||
|
|
register: enforce_apparmor_profiles
|
||
|
|
changed_when: enforce_apparmor_profiles.rc != 0
|
||
|
|
failed_when: enforce_apparmor_profiles.rc != 0
|
||
|
|
when: ansible_os_family == "Debian" and (get_apparmor_complaining.stdout != "0")
|
||
|
|
tags:
|
||
|
|
- apparmor
|
||
|
|
- CIS-UBUNTU2004-1.6.1.3
|
||
|
|
- CIS-UBUNTU2004-1.6.1.4
|
||
|
|
|
||
|
|
- name: Enable apparmor
|
||
|
|
become: true
|
||
|
|
ansible.builtin.systemd:
|
||
|
|
name: apparmor
|
||
|
|
enabled: true
|
||
|
|
state: started
|
||
|
|
when: ansible_os_family == "Debian"
|
||
|
|
tags:
|
||
|
|
- apparmor
|