Encryption and major changes

2024-09-28 23:12:19 +02:00
parent 1f060541c3
commit 6248286ad2
159 changed files with 153 additions and 129 deletions
@@ -0,0 +1,42 @@
+---
+- name: Remove risky suid bits
+  tags:
+    - suid
+    - CIS-UBUNTU2004-6.1.13
+    - CIS-UBUNTU2004-6.1.14
+  block:
+    - name: Find possible suid binaries
+      ansible.builtin.shell: |
+        command -v "{{ item }}"
+      args:
+        executable: /bin/bash
+      with_items:
+        - "{{ suid_sgid_blocklist }}"
+      register: find_result
+      changed_when: false
+      failed_when: false
+
+    - name: Stat permissions
+      ansible.builtin.stat:
+        path: "{{ item.stdout }}"
+      check_mode: true
+      register: suid_file
+      when:
+        - item.rc == 0
+      with_items:
+        - "{{ find_result.results }}"
+
+    - name: Remove suid/sgid permissions
+      become: true
+      ansible.builtin.file:
+        path: "{{ item.stat.path }}"
+        mode: 'a-s'
+        state: file
+        follow: true
+      when:
+        - item.stat.mode is defined
+        - item.stat.mode | int >= 2000
+        - item.stat.mode | int <= 5000
+      with_items:
+        - "{{ suid_file.results }}"
+...