ansible-hardening/tasks/rhel7stig/lsm.yml
Dmitriy Rabotyagov db5c6f2d66 Fix linters and metadata
With update of ansible-lint to version >=6.0.0 a lot of new
linters were added, that enabled by default. In order to comply
with linter rules we're applying changes to the role.

With that we also update metdata to reflect current state.

Change-Id: I1920cd05ac5b4d32ad12bce42d9161a568f288b6
2023-07-17 14:25:21 +02:00

139 lines
4.3 KiB
YAML

---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Check apparmor_status output
command: apparmor_status
register: apparmor_status_output
check_mode: no
changed_when: false
failed_when: false
when:
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
- security_rhel7_enable_linux_security_module | bool
tags:
- high
- V-71989
# NOTE(mhayden): The systemd unit file for apparmor just calls an old SysV
# init script and exits. It's not possible to ask systemd if apparmor is
# running and if we tell systemd to start apparmor, it will tell us that it
# started apparmor each time. This breaks idempotency and we check
# systemd's status directly as an alternative.
- name: Check if apparmor is running
command: "systemctl status apparmor" # noqa: command-instead-of-module
register: systemctl_apparmor_status
check_mode: no
changed_when: false
failed_when: false
when:
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
- security_rhel7_enable_linux_security_module | bool
tags:
- high
- V-71989
- name: Ensure AppArmor is enabled at boot time
service:
name: apparmor
enabled: yes
when:
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
- security_rhel7_enable_linux_security_module | bool
- not check_mode
tags:
- high
- V-71989
# NOTE(mhayden): Since the AppArmor systemd unit calls a SysV init script, the
# unit will always say AppArmor is dead. This means that the following task
# will always start the unit every time it runs (which breaks idempotency).
- name: Ensure AppArmor is running
service:
name: apparmor
state: started
changed_when:
- '"active (exited)" not in systemctl_apparmor_status.stdout'
when:
- ansible_facts['pkg_mgr'] in ['apt', 'zypper']
- security_rhel7_enable_linux_security_module | bool
- not check_mode
- '"apparmor filesystem is not mounted" not in apparmor_status_output.stderr'
tags:
- high
- V-71989
# NOTE(mhayden): The "changed_when" is required here because this task will
# always show as changed when SELinux is completely disabled. It's not possible
# to switch to permissive/enforcing in an online way when SELinux is completely
# disabled at boot time.
- name: Ensure SELinux is in enforcing mode on the next reboot
selinux:
state: enforcing
policy: targeted
register: selinux_status_change
changed_when: selinux_status_change is changed and ansible_facts['selinux']['status'] != 'disabled'
when:
- ansible_facts['os_family'] == "RedHat"
- security_rhel7_enable_linux_security_module | bool
tags:
- high
- V-71989
- V-71991
- name: Relabel files on next boot if SELinux mode changed
file:
path: /.autorelabel
state: touch
mode: "0644"
when:
- ansible_facts['os_family'] == "RedHat"
- security_rhel7_enable_linux_security_module | bool
- selinux_status_change is changed
tags:
- high
- V-71989
- V-71991
# NOTE(mhayden): Ansible's find module doesn't support searching for files
# based on SELinux contexts yet.
- name: Check for unlabeled device files
command: "find /dev -context '*unlabeled_t*'"
register: unlabeled_devices
changed_when: False
check_mode: no
when:
- ansible_facts['os_family'] == 'RedHat'
- ansible_facts['selinux']['status'] == 'enabled'
tags:
- lsm
- medium
- V-72039
- name: V-72039 - All system device files must be correctly labeled to prevent unauthorized modification.
debug:
msg: |
Devices were found without SELinux labels:
{% for device in unlabeled_devices.stdout_lines %}
{{ device }}
{% endfor %}
when:
- ansible_facts['os_family'] == 'RedHat'
- unlabeled_devices.stdout is defined
- unlabeled_devices.stdout | length > 0
tags:
- lsm
- medium
- V-72039