# platform = multi_platform_all
# reboot = true
# strategy = restrict
# complexity = low
# disruption = low
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify that Interactive Boot is Disabled - Verify GRUB_DISABLE_RECOVERY=true
  ansible.builtin.lineinfile:
    path: /etc/default/grub
    regexp: ^GRUB_DISABLE_RECOVERY=.*
    line: GRUB_DISABLE_RECOVERY=true
    state: present
  register: grub_disable_recovery_changed
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify that Interactive Boot is Disabled - Verify that Interactive Boot is
    Disabled in /etc/default/grub
  ansible.builtin.replace:
    dest: /etc/default/grub
    regexp: systemd.confirm_spawn(=(1|yes|true|on)|\b)
    replace: systemd.confirm_spawn=no
  register: grub_confirm_spawn_changed
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify that Interactive Boot is Disabled - Verify that Interactive Boot is
    Disabled (runtime)
  ansible.builtin.command: /sbin/grubby --update-kernel=ALL --remove-args="systemd.confirm_spawn"
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  - grub_confirm_spawn_changed is changed
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy

- name: Verify that Interactive Boot is Disabled - Regen grub.cfg handle updated GRUB_DISABLE_RECOVERY
    and confirm_spawn
  ansible.builtin.command: grub2-mkconfig -o  /boot/grub/grub.cfg
  when:
  - '"linux-base" in ansible_facts.packages'
  - '"grub2-common" in ansible_facts.packages'
  - grub_disable_recovery_changed is changed or grub_confirm_spawn_changed is changed
  tags:
  - NIST-800-171-3.1.2
  - NIST-800-171-3.4.5
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-2(1)
  - grub2_disable_interactive_boot
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
