Correct issue with ansible hardening and systemd
The systemd command does not have a stable api and can return different codes when executed. This change converts the task to query the target unit and disable it if it exists to a single systemd task using the ansible module. Closes-Bug: #1787048 Change-Id: I74c43839cd7d3a8620a0fb8e405fbc3f6a0f44d0 Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
This commit is contained in:
parent
dbb5ee90e3
commit
111f48b2f6
|
@ -36,22 +36,14 @@
|
||||||
- V-71985
|
- V-71985
|
||||||
|
|
||||||
# This returns an exit code of 0 if it's running, 3 if it's masked.
|
# This returns an exit code of 0 if it's running, 3 if it's masked.
|
||||||
- name: Check if ctrl-alt-del.target is already masked
|
|
||||||
command: systemctl status ctrl-alt-del.target
|
|
||||||
register: cad_mask_check
|
|
||||||
check_mode: no
|
|
||||||
changed_when: False
|
|
||||||
failed_when: cad_mask_check.rc not in [0,3]
|
|
||||||
tags:
|
|
||||||
- always
|
|
||||||
|
|
||||||
- name: V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled
|
- name: V-71993 - The x86 Ctrl-Alt-Delete key sequence must be disabled
|
||||||
command: systemctl mask ctrl-alt-del.target
|
systemd:
|
||||||
|
name: ctrl-alt-del.target
|
||||||
|
enabled: no
|
||||||
|
masked: yes
|
||||||
|
daemon_reload: yes
|
||||||
when:
|
when:
|
||||||
- security_rhel7_disable_ctrl_alt_delete | bool
|
- security_rhel7_disable_ctrl_alt_delete | bool
|
||||||
- cad_mask_check.rc != 3
|
|
||||||
notify:
|
|
||||||
- reload systemd
|
|
||||||
tags:
|
tags:
|
||||||
- high
|
- high
|
||||||
- misc
|
- misc
|
||||||
|
|
Loading…
Reference in New Issue