Encryption and major changes

2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
@@ -0,0 +1,94 @@
+---
+- name: Create /boot/grub directory if efi boot
+  become: true
+  ansible.builtin.file:
+    path: /boot/grub
+    state: directory
+    mode: "0755"
+    owner: root
+    group: root
+  when: booted_with_efi | bool
+  tags:
+    - grub
+
+- name: Run all notified handlers
+  ansible.builtin.meta: flush_handlers
+
+- name: Stat RedHat auditd GRUB settings
+  become: true
+  ansible.builtin.shell:
+    cmd: |
+      set -o pipefail
+      grubby --info="/boot/vmlinuz-$(uname -r)" | grep "^args.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"
+  changed_when: false
+  failed_when: false
+  args:
+    executable: /bin/bash
+  register: audit_grubenv
+  when: ansible_os_family == "RedHat"
+  ignore_errors: true
+  tags:
+    - auditd
+    - grub
+
+- name: Update grub2 if missing GRUB settings
+  become: true
+  ansible.builtin.command:
+    cmd: grub2-mkconfig
+  register: update_grub_redhat
+  changed_when: update_grub_redhat.rc != 0
+  failed_when: update_grub_redhat.rc != 0
+  when: ansible_os_family == "RedHat" and audit_grubenv.rc != 0
+  tags:
+    - auditd
+    - grub
+
+- name: Stat Debian auditd GRUB settings
+  become: true
+  ansible.builtin.shell: grep "linux.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}" /boot/grub/grub.cfg
+  changed_when: audit_grub_cfg.rc != 0
+  failed_when: audit_grub_cfg.rc != 0
+  register: audit_grub_cfg
+  ignore_errors: true
+  when: ansible_os_family == "Debian"
+  tags:
+    - auditd
+    - grub
+
+- name: Update GRUB if settings are missing
+  become: true
+  ansible.builtin.command:
+    cmd: update-grub
+  register: update_grub_debian
+  changed_when: update_grub_debian.rc != 0
+  failed_when: update_grub_debian.rc != 0
+  when: ansible_os_family == "Debian" and audit_grub_cfg.rc != 0
+  tags:
+    - auditd
+    - grub
+
+- name: Find GRUB config files
+  become: true
+  ansible.builtin.find:
+    paths: /boot
+    patterns: "*.cfg,grubenv"
+    recurse: true
+  register: grub_cfg
+  tags:
+    - grub
+    - CIS-UBUNTU2004-1.4.3
+
+- name: Set GRUB config permissions
+  become: true
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    mode: "0400"
+  when: item.mode | int > 400
+  changed_when: false
+  with_items:
+    - "{{ grub_cfg.files | reject('search', '/boot/efi/EFI/ubuntu/grub.cfg') | list }}"
+  loop_control:
+    label: "{{ item.path }}"
+  tags:
+    - grub
+    - CIS-UBUNTU2004-1.4.3