---
- name: Disable file system kernel modules
  become: true
  ansible.builtin.lineinfile:
    dest: /etc/modprobe.d/disablefs.conf
    line: "install {{ item }} /bin/true"
    mode: "0644"
    owner: root
    group: root
    state: present
    create: true
  with_items:
    - "{{ fs_modules_blocklist }}"
  tags:
    - modprobe
    - CCE-80835-2
    - CCE-81031-7
    - CIS-UBUNTU2004-1.1.1.1
    - CIS-UBUNTU2004-1.1.1.2
    - CIS-UBUNTU2004-1.1.1.3
    - CIS-UBUNTU2004-1.1.1.4
    - CIS-UBUNTU2004-1.1.1.5
    - CIS-UBUNTU2004-1.1.1.5
    - CIS-UBUNTU2004-1.1.1.6
    - CIS-UBUNTU2004-1.1.1.7
    - M1038
    - M1042