Encryption and major changes

ansible/roles/cis/tasks/disablemod.yml

@@ -0,0 +1,59 @@
+---
+- name: Disable misc kernel modules
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/modprobe.d/disablemod.conf
+    line: "install {{ item }} /bin/true"
+    mode: "0644"
+    owner: root
+    group: root
+    state: present
+    create: true
+  with_items:
+    - "{{ misc_modules_blocklist }}"
+  tags:
+    - modprobe
+    - CCE-80832-9
+    - CCE-82005-0
+    - CCE-82059-7
+    - CIS-UBUNTU2004-1.1.24
+    - M1034
+    - M1038
+    - M1042
+
+- name: Stat blacklisted kernel modules
+  environment:
+    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  ansible.builtin.shell: |
+    set -o pipefail
+    modprobe -c | grep -o '^blacklist .*' | awk '{print $2}'
+  args:
+    executable: /bin/bash
+  changed_when: false
+  failed_when: modprobe_blacklist.rc != 0
+  register: modprobe_blacklist
+  when: block_blacklisted | bool
+  tags:
+    - modprobe
+    - M1034
+    - M1038
+    - M1042
+
+- name: Block blacklisted kernel modules
+  become: true
+  ansible.builtin.lineinfile:
+    dest: /etc/modprobe.d/blockblacklisted.conf
+    line: "install {{ item }} /bin/true"
+    mode: "0644"
+    owner: root
+    group: root
+    state: present
+    create: true
+  with_items:
+    - "{{ modprobe_blacklist.stdout_lines | sort }}"
+  when: block_blacklisted | bool
+  tags:
+    - modprobe
+    - M1034
+    - M1038
+    - M1042