# platform = multi_platform_all
# reboot = true
# strategy = restrict
# complexity = low
# disruption = low
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Collect all files from /etc/audit/rules.d
    with .rules extension
  ansible.builtin.find:
    paths: /etc/audit/rules.d/
    patterns: '*.rules'
  register: find_rules_d
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Check if target files exist and
    get their content
  ansible.builtin.stat:
    path: '{{ item }}'
  register: audit_files_stat
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Read content of existing audit files
  ansible.builtin.slurp:
    src: '{{ item.item }}'
  register: audit_files_content
  loop: '{{ audit_files_stat.results }}'
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - item.stat.exists
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Check if -e 2 is already correctly
    set in target files
  ansible.builtin.set_fact:
    immutable_correctly_set: |-
      {{
        audit_files_content.results
        | selectattr('content', 'defined')
        | map(attribute='content')
        | map('b64decode')
        | select('search', '^-e 2$', multiline=True)
        | list
        | length == 2
      }}
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Remove any existing -e option from
    all Audit config files
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    regexp: ^\s*-e\s+.*$
    state: absent
  loop: '{{ find_rules_d.files | map(attribute=''path'') | list + [''/etc/audit/audit.rules'']
    }}'
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not immutable_correctly_set
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Ensure target directories exist
  ansible.builtin.file:
    path: '{{ item | dirname }}'
    state: directory
    mode: '0750'
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not immutable_correctly_set
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Make the auditd Configuration Immutable - Add Audit -e 2 option to make rules
    immutable
  ansible.builtin.lineinfile:
    path: '{{ item }}'
    create: true
    line: -e 2
    regexp: ^\s*-e\s+.*$
    mode: g-rwx,o-rwx
  loop:
  - /etc/audit/audit.rules
  - /etc/audit/rules.d/immutable.rules
  when:
  - '"auditd" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not immutable_correctly_set
  tags:
  - CJIS-5.4.1.1
  - NIST-800-171-3.3.1
  - NIST-800-171-3.4.3
  - NIST-800-53-AC-6(9)
  - NIST-800-53-CM-6(a)
  - PCI-DSS-Req-10.5.2
  - PCI-DSSv4-10.3
  - PCI-DSSv4-10.3.2
  - audit_rules_immutable
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
