Mirrors/ansible-collection-hardening
2
0
Fork 0
mirror of https://github.com/dev-sec/ansible-collection-hardening synced 2024-11-10 09:14:18 +00:00
Code Issues Projects Releases Packages Wiki Activity

add more conditionals to when auditd show be hardened

Browse source 
Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
This commit is contained in:
Sebastian Gumprich 2022-07-15 09:08:26 +02:00
parent 862edbbe40
commit 26e37cabc5
1 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
roles/os_hardening/tasks/minimize_access.yml
View file

@ -221,7 +221,10 @@
opts: '{{ os_mnt_var_log_audit_options }}'
state: present
register: varlogauditmount
when: os_mnt_var_log_audit_enabled | bool
when:
- os_mnt_var_log_audit_enabled | bool
- var_log_audit_exists.stat.exists | bool
- os_auditd_enabled | bool
- name: Harden permissions for /var/log/audit directory
file:
@ -230,6 +233,7 @@
group: 'root'
mode: '{{ os_mnt_var_log_audit_dir_mode }}'
when:
- os_mnt_var_log_audit_enabled | bool
- var_log_audit_exists.stat.exists | bool
- os_auditd_enabled | bool