1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
|
# platform = multi_platform_all
# reboot = true
# strategy = disable
# complexity = low
# disruption = medium
- name: List /etc/sysctl.d/*.conf files
{{% if product in ["sle12", "sle15", "slmicro5", "slmicro6"] %}}
ansible.builtin.find:
paths:
- "/run/sysctl.d/"
- "/etc/sysctl.d/"
- "/usr/local/lib/sysctl.d/"
- "/lib/sysctl.d/"
{{% else %}}
ansible.builtin.find:
paths:
- "/etc/sysctl.d/"
- "/run/sysctl.d/"
- "/usr/local/lib/sysctl.d/"
{{% endif %}}
{{% if product not in [ "ol7", "ol8", "ol9", "rhcos4", "rhel8", "rhel9", "rhel10", "sle12", "sle15", "slmicro5", "slmicro6", "ubuntu2204", "ubuntu2404"] %}}
- "/usr/lib/sysctl.d/"
{{% endif %}}
contains: '^[\s]*{{{ SYSCTLVAR }}}.*$'
patterns: "*.conf"
file_type: any
register: find_sysctl_d
- name: Comment out any occurrences of {{{ SYSCTLVAR }}} from config files
ansible.builtin.replace:
path: "{{ item.path }}"
regexp: '^[\s]*{{{ SYSCTLVAR }}}'
replace: '#{{{ SYSCTLVAR }}}'
loop: "{{ find_sysctl_d.files }}"
{{% if product in [ "ubuntu2204", "ubuntu2404"] %}}
- name: Comment out any occurrences of {{{ SYSCTLVAR }}} from /etc/ufw/sysctl.conf
ansible.builtin.replace:
path: "/etc/ufw/sysctl.conf"
regexp: '(^[\s]*{{{ SYSCTLVAR }}}.*$)'
replace: '# \1'
{{% endif %}}
{{% if sysctl_remediate_drop_in_file == "true" %}}
- name: Comment out any occurrences of {{{ SYSCTLVAR }}} from /etc/sysctl.conf
ansible.builtin.replace:
path: "/etc/sysctl.conf"
regexp: '^[\s]*{{{ SYSCTLVAR }}}'
replace: '#{{{ SYSCTLVAR }}}'
{{% endif %}}
{{%- if SYSCTLVAL == "" or SYSCTLVAL is not string %}}
- (xccdf-var sysctl_{{{ SYSCTLID }}}_value)
- name: Ensure sysctl {{{ SYSCTLVAR }}} is set
ansible.posix.sysctl:
name: "{{{ SYSCTLVAR }}}"
value: "{{ sysctl_{{{ SYSCTLID }}}_value }}"
{{%- else %}}
- name: Ensure sysctl {{{ SYSCTLVAR }}} is set to {{{ SYSCTLVAL }}}
ansible.posix.sysctl:
name: "{{{ SYSCTLVAR }}}"
value: "{{{ SYSCTLVAL }}}"
{{%- endif %}}
{{% if sysctl_remediate_drop_in_file == "true" %}}
sysctl_file: "/etc/sysctl.d/{{{ SYSCTLVAR | replace('.','_') }}}.conf"
{{% else %}}
sysctl_file: "/etc/sysctl.conf"
{{% endif %}}
state: present
reload: yes
|
