db5c6f2d66
With update of ansible-lint to version >=6.0.0 a lot of new linters were added, that enabled by default. In order to comply with linter rules we're applying changes to the role. With that we also update metdata to reflect current state. Change-Id: I1920cd05ac5b4d32ad12bce42d9161a568f288b6
139 lines
4.3 KiB
YAML
139 lines
4.3 KiB
YAML
---
|
|
# Copyright 2016, Rackspace US, Inc.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
- name: Check apparmor_status output
|
|
command: apparmor_status
|
|
register: apparmor_status_output
|
|
check_mode: no
|
|
changed_when: false
|
|
failed_when: false
|
|
when:
|
|
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
|
|
- security_rhel7_enable_linux_security_module | bool
|
|
tags:
|
|
- high
|
|
- V-71989
|
|
|
|
# NOTE(mhayden): The systemd unit file for apparmor just calls an old SysV
|
|
# init script and exits. It's not possible to ask systemd if apparmor is
|
|
# running and if we tell systemd to start apparmor, it will tell us that it
|
|
# started apparmor each time. This breaks idempotency and we check
|
|
# systemd's status directly as an alternative.
|
|
- name: Check if apparmor is running
|
|
command: "systemctl status apparmor" # noqa: command-instead-of-module
|
|
register: systemctl_apparmor_status
|
|
check_mode: no
|
|
changed_when: false
|
|
failed_when: false
|
|
when:
|
|
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
|
|
- security_rhel7_enable_linux_security_module | bool
|
|
tags:
|
|
- high
|
|
- V-71989
|
|
|
|
- name: Ensure AppArmor is enabled at boot time
|
|
service:
|
|
name: apparmor
|
|
enabled: yes
|
|
when:
|
|
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
|
|
- security_rhel7_enable_linux_security_module | bool
|
|
- not check_mode
|
|
tags:
|
|
- high
|
|
- V-71989
|
|
|
|
# NOTE(mhayden): Since the AppArmor systemd unit calls a SysV init script, the
|
|
# unit will always say AppArmor is dead. This means that the following task
|
|
# will always start the unit every time it runs (which breaks idempotency).
|
|
- name: Ensure AppArmor is running
|
|
service:
|
|
name: apparmor
|
|
state: started
|
|
changed_when:
|
|
- '"active (exited)" not in systemctl_apparmor_status.stdout'
|
|
when:
|
|
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
|
|
- security_rhel7_enable_linux_security_module | bool
|
|
- not check_mode
|
|
- '"apparmor filesystem is not mounted" not in apparmor_status_output.stderr'
|
|
tags:
|
|
- high
|
|
- V-71989
|
|
|
|
# NOTE(mhayden): The "changed_when" is required here because this task will
|
|
# always show as changed when SELinux is completely disabled. It's not possible
|
|
# to switch to permissive/enforcing in an online way when SELinux is completely
|
|
# disabled at boot time.
|
|
- name: Ensure SELinux is in enforcing mode on the next reboot
|
|
selinux:
|
|
state: enforcing
|
|
policy: targeted
|
|
register: selinux_status_change
|
|
changed_when: selinux_status_change is changed and ansible_facts['selinux']['status'] != 'disabled'
|
|
when:
|
|
- ansible_facts['os_family'] == "RedHat"
|
|
- security_rhel7_enable_linux_security_module | bool
|
|
tags:
|
|
- high
|
|
- V-71989
|
|
- V-71991
|
|
|
|
- name: Relabel files on next boot if SELinux mode changed
|
|
file:
|
|
path: /.autorelabel
|
|
state: touch
|
|
mode: "0644"
|
|
when:
|
|
- ansible_facts['os_family'] == "RedHat"
|
|
- security_rhel7_enable_linux_security_module | bool
|
|
- selinux_status_change is changed
|
|
tags:
|
|
- high
|
|
- V-71989
|
|
- V-71991
|
|
|
|
# NOTE(mhayden): Ansible's find module doesn't support searching for files
|
|
# based on SELinux contexts yet.
|
|
- name: Check for unlabeled device files
|
|
command: "find /dev -context '*unlabeled_t*'"
|
|
register: unlabeled_devices
|
|
changed_when: False
|
|
check_mode: no
|
|
when:
|
|
- ansible_facts['os_family'] == 'RedHat'
|
|
- ansible_facts['selinux']['status'] == 'enabled'
|
|
tags:
|
|
- lsm
|
|
- medium
|
|
- V-72039
|
|
|
|
- name: V-72039 - All system device files must be correctly labeled to prevent unauthorized modification.
|
|
debug:
|
|
msg: |
|
|
Devices were found without SELinux labels:
|
|
{% for device in unlabeled_devices.stdout_lines %}
|
|
{{ device }}
|
|
{% endfor %}
|
|
when:
|
|
- ansible_facts['os_family'] == 'RedHat'
|
|
- unlabeled_devices.stdout is defined
|
|
- unlabeled_devices.stdout | length > 0
|
|
tags:
|
|
- lsm
|
|
- medium
|
|
- V-72039
|