a13labs.infra/ansible/roles/cis_hardening/tasks/packages.yml

---
- name: Merge package lists
  ansible.builtin.set_fact:
    packages_merged: "{{ packages_debian + packages_redhat + packages_ubuntu }}"
  tags:
    - packages

- name: Configure needrestart
  tags:
    - needrestart
    - packages
  block:
    - name: Pre register needrestart configuration directory
      become: true
      ansible.builtin.stat:
        path: /etc/needrestart/conf.d
      register: needrestart_directory_created

    - name: Create needrestart directory
      become: true
      ansible.builtin.file:
        path: /etc/needrestart/conf.d
        state: directory
        owner: root
        group: root
        mode: "0755"
        recurse: true
      when: ("needrestart" in packages_merged) and not needrestart_directory_created.stat.exists

    - name: Stat needrestart configuration directory
      become: true
      ansible.builtin.stat:
        path: /etc/needrestart/conf.d
      register: needrestart_directory

    - name: Get needrestart restart value
      ansible.builtin.command:
        cmd: grep -Rqo "$nrconf{restart} = 'l';" /etc/needrestart/conf.d/
      register: needrestart_restart_set
      when: needrestart_directory.stat.exists
      changed_when: needrestart_restart_set.rc != 0
      failed_when: needrestart_restart_set.rc > 1

    - name: Configure needrestart
      become: true
      ansible.builtin.lineinfile:
        path: /etc/needrestart/conf.d/00-restart.conf
        line: "$nrconf{restart} = 'l';"
        create: true
        owner: root
        group: root
        mode: "0644"
      when: needrestart_directory.stat.exists and needrestart_restart_set.rc != 0

- name: Debian family package installation
  become: true
  ansible.builtin.apt:
    name: "{{ packages_debian }}"
    state: present
    install_recommends: false
  when: ansible_os_family == "Debian"
  tags:
    - packages
    - CIS-UBUNTU2004-1.6.1.1
    - CIS-UBUNTU2004-4.1.1.1
    - CIS-UBUNTU2004-4.2.1.1
    - M1049
    - UBTU-20-010005

- name: Ubuntu package installation
  become: true
  ansible.builtin.apt:
    name: "{{ packages_ubuntu }}"
    state: present
    install_recommends: false
  when: ansible_distribution == "Ubuntu"
  tags:
    - packages

- name: Ubuntu update-notifier-common package installation
  become: true
  ansible.builtin.apt:
    name: "update-notifier-common"
    state: present
    install_recommends: false
  when: ansible_distribution == "Ubuntu"
  tags:
    - packages

- name: RedHat family package installation
  become: true
  ansible.builtin.dnf:
    name: "{{ packages_redhat }}"
    state: present
  when: ansible_os_family == "RedHat"
  notify:
    - Enable haveged
  tags:
    - packages
    - CCE-80847-7
    - CCE-81043-2
    - CCE-82859-0
    - CCE-83303-8
    - M1049

- name: Run apt purge
  become: true
  ansible.builtin.apt:
    name: "{{ packages_blocklist }}"
    state: absent
    purge: true
  when: ansible_os_family == "Debian"
  register: apt_purge
  failed_when: apt_purge is not success and not "No package" in apt_purge.msg
  tags:
    - packages
    - M1042

- name: Generic package removal
  become: true
  ansible.builtin.package:
    name: "{{ packages_blocklist }}"
    state: absent
  register: package_removal
  failed_when: package_removal is not success and not "No package" in package_removal.msg
  tags:
    - packages
    - CCE-80873-3
    - CCE-82182-7
    - CCE-82184-3
    - CCE-82436-7
    - CIS-UBUNTU2004-1.1.23
    - CIS-UBUNTU2004-1.5.3
    - CIS-UBUNTU2004-2.1.3
    - CIS-UBUNTU2004-2.1.16
    - CIS-UBUNTU2004-2.2.2
    - CIS-UBUNTU2004-2.2.3
    - CIS-UBUNTU2004-2.2.4
    - CIS-UBUNTU2004-2.2.6
    - M1042

- name: VirtualBox guest packages installation
  become: true
  ansible.builtin.apt:
    name: "{{ packages }}"
    state: present
    install_recommends: false
  vars:
    packages:
      - virtualbox-guest-dkms
      - virtualbox-guest-utils
  register: virtualbox_packages
  when: ansible_virtualization_type == "VirtualBox" and
    ansible_distribution == "Ubuntu"
  failed_when: virtualbox_packages is not success and not "No package matching" in virtualbox_packages.msg
  tags:
    - packages
    - virtualbox

- name: VMWare package installation
  become: true
  ansible.builtin.package:
    name: open-vm-tools
    state: present
  when: ansible_virtualization_type == "VMware"
  tags:
    - packages
    - vmware

- name: QEMU package installation
  become: true
  ansible.builtin.package:
    name: qemu-guest-agent
    state: present
  when: ansible_system_vendor == "QEMU"
  tags:
    - packages
    - qemu

- name: Install rng-tools
  become: true
  ansible.builtin.package:
    name: rng-tools
    state: present
  when: ansible_local.cpuinfo.rdrand
  tags:
    - rng-tools
    - packages
    - CCE-82968-9

- name: Stat sysstat default
  become: true
  ansible.builtin.stat:
    path: /etc/default/sysstat
  register: default_sysstat
  tags:
    - packages
    - sysstat

- name: Enable sysstat
  become: true
  ansible.builtin.lineinfile:
    regexp: "^ENABLED"
    line: 'ENABLED="true"'
    dest: /etc/default/sysstat
    mode: "0644"
    state: present
    create: false
    backrefs: true
  when: default_sysstat.stat.exists
  tags:
    - packages
    - sysstat

- name: Remove unneeded Debian dependencies
  become: true
  ansible.builtin.apt:
    autoclean: true
    autoremove: true
  when: ansible_os_family == "Debian"
  tags:
    - packages