---
- name: Mount /proc with additional options
  become: true
  ansible.posix.mount:
    name: /proc
    src: none
    fstype: proc
    opts: rw,nosuid,nodev,noexec,relatime,hidepid={{ hide_pid | int }},gid={{ process_group }}
    state: present
  tags:
    - mount
    - proc

- name: Stat /dev/shm
  ansible.builtin.stat:
    path: /dev/shm
  register: dev_shm
  tags:
    - mount
    - shm

- name: Mount /dev/shm with noexec
  become: true
  ansible.posix.mount:
    name: /dev/shm
    src: none
    fstype: tmpfs
    opts: rw,nosuid,nodev,noexec
    state: present
  when: dev_shm.stat.exists
  tags:
    - mount
    - shm
    - CCE-80837-8
    - CCE-80838-6
    - CCE-80839-4
    - CIS-UBUNTU2004-1.1.7
    - CIS-UBUNTU2004-1.1.8
    - CIS-UBUNTU2004-1.1.9

- name: Add systemd tmp.mount
  become: true
  ansible.builtin.template:
    src: etc/systemd/tmp.mount.j2
    dest: /etc/systemd/system/tmp.mount
    backup: true
    mode: "0644"
    owner: root
    group: root
  tags:
    - mount
    - tmp
    - CCE-82139-7
    - CCE-82140-5
    - CCE-82623-0

- name: Stat tmp.mount
  ansible.builtin.stat:
    path: /etc/systemd/system/tmp.mount
  register: tmp_mount
  tags:
    - mount
    - tmp

- name: Unmask tmp.mount
  become: true
  ansible.builtin.systemd:
    name: tmp.mount
    masked: false
  when: tmp_mount.stat.exists
  tags:
    - mount
    - tmp

- name: Start tmp.mount
  become: true
  ansible.builtin.systemd:
    name: tmp.mount
    daemon_reload: true
    state: started
    enabled: true
  when: tmp_mount.stat.exists
  tags:
    - mount
    - tmp