# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low

- name: Ensure noexec is enabled in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: '^[\s]*Defaults.*\bnoexec\b.*$'
    line: 'Defaults noexec'
    validate: /usr/sbin/visudo -cf %s
