---
- name: Disable kernel network modules
  become: true
  ansible.builtin.lineinfile:
    dest: /etc/modprobe.d/disablenet.conf
    line: "install {{ item }} /bin/true"
    mode: "0644"
    owner: root
    group: root
    state: present
    create: true
  with_items:
    - "{{ net_modules_blocklist }}"
  tags:
    - modprobe
    - CCE-80834-5
    - CCE-82028-2
    - CCE-82297-3
    - CIS-UBUNTU2004-3.4.1
    - CIS-UBUNTU2004-3.4.2
    - CIS-UBUNTU2004-3.4.3
    - CIS-UBUNTU2004-3.4.4
    - M1038
    - M1042