# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low






- name: Record Events that Modify User/Group Information - /etc/group - Check if watch rule for /etc/group already exists in /etc/audit/rules.d/
  ansible.builtin.find:
    paths: "/etc/audit/rules.d"

    contains: '^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+'

    patterns: "*.rules"
  register: find_existing_watch_rules_d

- name: Record Events that Modify User/Group Information - /etc/group - Search /etc/audit/rules.d for other rules with specified key audit_rules_usergroup_modification
  ansible.builtin.find:
    paths: "/etc/audit/rules.d"
    contains: '^.*(?:-F key=|-k\s+)audit_rules_usergroup_modification$'
    patterns: "*.rules"
  register: find_watch_key
  when: find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Record Events that Modify User/Group Information - /etc/group - Use /etc/audit/rules.d/audit_rules_usergroup_modification.rules as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
      - /etc/audit/rules.d/audit_rules_usergroup_modification.rules
  when: find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Record Events that Modify User/Group Information - /etc/group - Use matched file as the recipient for the rule
  ansible.builtin.set_fact:
    all_files:
      - "{{ find_watch_key.files | map(attribute='path') | list | first }}"
  when: find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Record Events that Modify User/Group Information - /etc/group - Add watch rule for /etc/group in /etc/audit/rules.d/
  ansible.builtin.lineinfile:
    path: "{{ all_files[0] }}"

    line: "-w /etc/group -p wa -k audit_rules_usergroup_modification"

    create: yes
    mode: '0600'
  when: find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0
- name: Record Events that Modify User/Group Information - /etc/group - Check if watch rule for /etc/group already exists in /etc/audit/audit.rules
  ansible.builtin.find:
    paths: "/etc/audit/"

    contains: '^\s*-w\s+/etc/group\s+-p\s+wa(\s|$)+'

    patterns: "audit.rules"
  register: find_existing_watch_audit_rules

- name: Record Events that Modify User/Group Information - /etc/group - Add watch rule for /etc/group in /etc/audit/audit.rules
  ansible.builtin.lineinfile:

    line: "-w /etc/group -p wa -k audit_rules_usergroup_modification"

    state: present
    dest: /etc/audit/audit.rules
    create: yes
    mode: '0600'
  when: find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched == 0
