---
- name: Create /boot/grub directory if efi boot
  become: true
  ansible.builtin.file:
    path: /boot/grub
    state: directory
    mode: "0755"
    owner: root
    group: root
  when: booted_with_efi | bool
  tags:
    - grub

- name: Run all notified handlers
  ansible.builtin.meta: flush_handlers

- name: Stat RedHat auditd GRUB settings
  become: true
  ansible.builtin.shell:
    cmd: |
      set -o pipefail
      grubby --info="/boot/vmlinuz-$(uname -r)" | grep "^args.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}"
  changed_when: false
  failed_when: false
  args:
    executable: /bin/bash
  register: audit_grubenv
  when: ansible_os_family == "RedHat"
  ignore_errors: true
  tags:
    - auditd
    - grub

- name: Update grub2 if missing GRUB settings
  become: true
  ansible.builtin.command:
    cmd: grub2-mkconfig
  register: update_grub_redhat
  changed_when: update_grub_redhat.rc != 0
  failed_when: update_grub_redhat.rc != 0
  when: ansible_os_family == "RedHat" and audit_grubenv.rc != 0
  tags:
    - auditd
    - grub

- name: Stat Debian auditd GRUB settings
  become: true
  ansible.builtin.shell: grep "linux.*{{ grub_audit_cmdline }} {{ grub_audit_backlog_cmdline }}" /boot/grub/grub.cfg
  changed_when: audit_grub_cfg.rc != 0
  failed_when: audit_grub_cfg.rc != 0
  register: audit_grub_cfg
  ignore_errors: true
  when: ansible_os_family == "Debian"
  tags:
    - auditd
    - grub

- name: Update GRUB if settings are missing
  become: true
  ansible.builtin.command:
    cmd: update-grub
  register: update_grub_debian
  changed_when: update_grub_debian.rc != 0
  failed_when: update_grub_debian.rc != 0
  when: ansible_os_family == "Debian" and audit_grub_cfg.rc != 0
  tags:
    - auditd
    - grub

- name: Find GRUB config files
  become: true
  ansible.builtin.find:
    paths: /boot
    patterns: "*.cfg,grubenv"
    recurse: true
  register: grub_cfg
  tags:
    - grub
    - CIS-UBUNTU2004-1.4.3

- name: Set GRUB config permissions
  become: true
  ansible.builtin.file:
    path: "{{ item.path }}"
    mode: "0400"
  when: item.mode | int > 400
  changed_when: false
  with_items:
    - "{{ grub_cfg.files | reject('search', '/boot/efi/EFI/ubuntu/grub.cfg') | list }}"
  loop_control:
    label: "{{ item.path }}"
  tags:
    - grub
    - CIS-UBUNTU2004-1.4.3