mirror of
https://github.com/dev-sec/ansible-collection-hardening
synced 2024-09-20 13:21:52 +00:00
5ed3f399f2
* add check mode to molecule tests Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com> * bail on undefined variables Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com> * bail on undefined variables Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com> * execute tasks in check mode Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com> * fix error in check mode on SuSE Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com> * use when condition on task Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com> --------- Signed-off-by: Martin Schurz <Martin.Schurz@t-systems.com>
33 lines
1.2 KiB
YAML
33 lines
1.2 KiB
YAML
---
|
|
- name: Remove suid/sgid bit from binaries in blacklist | os-06
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
mode: a-s
|
|
state: file
|
|
follow: true
|
|
failed_when: false
|
|
with_community.general.flattened:
|
|
- "{{ os_security_suid_sgid_system_blacklist }}"
|
|
- "{{ os_security_suid_sgid_blacklist }}"
|
|
|
|
- name: Find binaries with suid/sgid set | os-06
|
|
ansible.builtin.shell: find / -xdev \( -perm -4000 -o -perm -2000 \) -type f ! -path '/proc/*' -print 2>/dev/null
|
|
register: sbit_binaries
|
|
when: os_security_suid_sgid_remove_from_unknown | bool
|
|
changed_when: false
|
|
check_mode: false
|
|
|
|
- name: Gather files from which to remove suids/sgids and remove system white-listed files | os-06
|
|
ansible.builtin.set_fact:
|
|
suid: "{{ sbit_binaries.stdout_lines | difference(os_security_suid_sgid_system_whitelist) }}"
|
|
when: os_security_suid_sgid_remove_from_unknown | bool
|
|
|
|
- name: Remove suid/sgid bit from all binaries except in system and user whitelist | os-06
|
|
ansible.builtin.file:
|
|
path: "{{ item }}"
|
|
mode: a-s
|
|
state: file
|
|
follow: true
|
|
with_community.general.flattened:
|
|
- "{{ suid | default([]) | difference(os_security_suid_sgid_whitelist) }}"
|
|
when: os_security_suid_sgid_remove_from_unknown | bool
|