---
- name: Disable misc kernel modules
  become: true
  ansible.builtin.lineinfile:
    dest: /etc/modprobe.d/disablemod.conf
    line: "install {{ item }} /bin/true"
    mode: "0644"
    owner: root
    group: root
    state: present
    create: true
  with_items:
    - "{{ misc_modules_blocklist }}"
  tags:
    - modprobe
    - CCE-80832-9
    - CCE-82005-0
    - CCE-82059-7
    - CIS-UBUNTU2004-1.1.24
    - M1034
    - M1038
    - M1042

- name: Stat blacklisted kernel modules
  environment:
    PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
  ansible.builtin.shell: |
    set -o pipefail
    modprobe -c | grep -o '^blacklist .*' | awk '{print $2}'
  args:
    executable: /bin/bash
  changed_when: false
  failed_when: modprobe_blacklist.rc != 0
  register: modprobe_blacklist
  when: block_blacklisted | bool
  tags:
    - modprobe
    - M1034
    - M1038
    - M1042

- name: Block blacklisted kernel modules
  become: true
  ansible.builtin.lineinfile:
    dest: /etc/modprobe.d/blockblacklisted.conf
    line: "install {{ item }} /bin/true"
    mode: "0644"
    owner: root
    group: root
    state: present
    create: true
  with_items:
    - "{{ modprobe_blacklist.stdout_lines | sort }}"
  when: block_blacklisted | bool
  tags:
    - modprobe
    - M1034
    - M1038
    - M1042