Initial ansible onboard

ansible/roles/cis_hardening/tasks/compilers.yml

@@ -0,0 +1,35 @@
+---
+- name: Stat available compilers
+  become: true
+  ansible.builtin.find:
+    paths:
+      [
+        "/usr/local/sbin",
+        "/usr/local/bin",
+        "/usr/sbin",
+        "/usr/bin",
+        "/sbin",
+        "/bin",
+        "/snap/bin",
+      ]
+    patterns: "{{ compilers }}"
+    file_type: any
+    follow: true
+    recurse: true
+  register: compiler
+  tags:
+    - compilers
+
+- name: Restrict compiler access
+  become: true
+  ansible.builtin.file:
+    path: "{{ item.path }}"
+    owner: root
+    group: root
+    mode: "0750"
+    state: file
+    follow: true
+  with_items:
+    - "{{ compiler.files }}"
+  tags:
+    - compilers