Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

A fix into ansible part of the rule audit_rules_suid_privilege_function #11170

Merged
merged 7 commits into from
Dec 5, 2023
Merged

A fix into ansible part of the rule audit_rules_suid_privilege_function #11170

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
9921054
A fix into ansible part of the rule audit_rules_suid_privilege_function
rumch-se Oct 3, 2023
89d2e8e
Created test cases covering /etc/audit/rules.d/privileged.rules and /…
rumch-se Oct 4, 2023
a519a5a
Additional changes into ansible part
rumch-se Nov 2, 2023
f7def62
Modification of ansible part and test files, 2 additional tests added
rumch-se Nov 7, 2023
0543ca5
Revert "Modification of ansible part and test files, 2 additional tes…
rumch-se Nov 27, 2023
b63904f
Revert "Additional changes into ansible part"
rumch-se Nov 27, 2023
c1b87fd
Revert "Created test cases covering /etc/audit/rules.d/privileged.rul…
rumch-se Nov 27, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 5 additions & 11 deletions ...em/auditing/auditd_configure_rules/audit_rules_suid_privilege_function/ansible/shared.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,13 +26,6 @@
- name: Service facts
ansible.builtin.service_facts:

- name: Check the rules script being used
ansible.builtin.command:
grep '^ExecStartPost' /usr/lib/systemd/system/auditd.service
register: check_rules_scripts_result
changed_when: false
failed_when: false

- name: Set suid_audit_rules fact
ansible.builtin.set_fact:
suid_audit_rules:
Expand All @@ -52,8 +45,8 @@
regexp: "{{ item.regex }}"
create: yes
when:
- '"auditd.service" in ansible_facts.services'
- '"augenrules" in check_rules_scripts_result.stdout'
- ('"auditd.service" in ansible_facts.services' or
rumch-se marked this conversation as resolved.
Show resolved Hide resolved
'"augenrules.service" in ansible_facts.services')
register: augenrules_audit_rules_privilege_function_update_result
with_items: "{{ suid_audit_rules }}"

Expand All @@ -64,10 +57,11 @@
regexp: "{{ item.regex }}"
create: yes
when:
- '"auditd.service" in ansible_facts.services'
- '"auditctl" in check_rules_scripts_result.stdout'
- ('"auditd.service" in ansible_facts.services' or
'"augenrules.service" in ansible_facts.services')
register: auditctl_audit_rules_privilege_function_update_result
with_items: "{{ suid_audit_rules }}"

{{%- if product in ['sle12', 'sle15'] %}}
- name: Restart auditd.service
ansible.builtin.systemd:
Expand Down
Loading