# platform = multi_platform_all
# reboot = true
# strategy = restrict
# complexity = low
# disruption = low
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Ensure the Audit Configuration is Loaded Regardless of Errors - Collect all
    files from /etc/audit/rules.d with .rules extension
  ansible.builtin.find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Ensure the Audit Configuration is Loaded Regardless of Errors - Check if target
    files exist and get their content
  ansible.builtin.stat:
    path: '{{ item }}'
  register: audit_files_stat
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/01-initialize.rules
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Ensure the Audit Configuration is Loaded Regardless of Errors - Read content
    of existing audit files
  ansible.builtin.slurp:
    src: '{{ item.item }}'
  register: audit_files_content
  loop: '{{ audit_files_stat.results }}'
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - item.stat.exists
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Ensure the Audit Configuration is Loaded Regardless of Errors - Check if -c
    is already correctly set in target files
  ansible.builtin.set_fact:
    continue_loading_correctly_set: |-
      {{
        audit_files_content.results
        | selectattr('content', 'defined')
        | map(attribute='content')
        | map('b64decode')
        | select('search', '^-c$', multiline=True)
        | list
        | length == 2
      }}
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Ensure the Audit Configuration is Loaded Regardless of Errors - Remove any
    existing -c option from all Audit config files
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    regexp: ^\s*-c\s*.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not continue_loading_correctly_set
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Ensure the Audit Configuration is Loaded Regardless of Errors - Ensure target
    directories exist
  ansible.builtin.file:
    path: '{{ item | dirname }}'
    state: directory
    mode: '0750'
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/01-initialize.rules
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not continue_loading_correctly_set
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Ensure the Audit Configuration is Loaded Regardless of Errors - Add Audit
    -c option to make rules continue loading
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    create: true
    line: -c
    regexp: ^\s*-c\s*.*$
    insertbefore: BOF
    mode: g-rwx,o-rwx
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/01-initialize.rules
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not continue_loading_correctly_set
  tags:
  - audit_rules_continue_loading
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
