# platform = multi_platform_all
# reboot = false
# strategy = unknown
# complexity = low
# disruption = medium
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Make sure that the dconf databases are up-to-date with regards to respective
    keyfiles - Get database modification time for gdm
  ansible.builtin.stat:
    path: /etc/dconf/db/gdm
  register: gdm_db
  when:
  - '"gdm3" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Make sure that the dconf databases are up-to-date with regards to respective
    keyfiles - Get keyfiles for gdm
  ansible.builtin.find:
    paths: /etc/dconf/db/gdm.d/
  register: gdm_keyfiles
  when:
  - '"gdm3" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Make sure that the dconf databases are up-to-date with regards to respective
    keyfiles - Run dconf update for gdm
  ansible.builtin.command:
    cmd: dconf update
  when:
  - '"gdm3" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not gdm_db.stat.exists or gdm_keyfiles.files | length > 0 and gdm_keyfiles.files
    | map(attribute='mtime') | max > gdm_db.stat.mtime
  tags:
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Make sure that the dconf databases are up-to-date with regards to respective
    keyfiles - Get database modification time for local
  ansible.builtin.stat:
    path: /etc/dconf/db/local
  register: local_db
  when:
  - '"gdm3" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Make sure that the dconf databases are up-to-date with regards to respective
    keyfiles - Get keyfiles for local
  ansible.builtin.find:
    paths: /etc/dconf/db/local.d/
  register: local_keyfiles
  when:
  - '"gdm3" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  tags:
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Make sure that the dconf databases are up-to-date with regards to respective
    keyfiles - Run dconf update for local
  ansible.builtin.command:
    cmd: dconf update
  when:
  - '"gdm3" in ansible_facts.packages'
  - '"linux-base" in ansible_facts.packages'
  - not local_db.stat.exists or local_keyfiles.files | length > 0 and local_keyfiles.files
    | map(attribute='mtime') | max > local_db.stat.mtime
  tags:
  - PCI-DSS-Req-6.2
  - PCI-DSSv4-8.2
  - PCI-DSSv4-8.2.8
  - dconf_db_up_to_date
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy
