# platform = multi_platform_all
# reboot = false
# strategy = configure
# complexity = low
# disruption = high
- name: 'Add nosuid Option to /opt: Check information associated to mountpoint'
  command: findmnt --fstab '/opt'
  register: device_name
  failed_when: device_name.rc > 1
  changed_when: false
  check_mode: false
  when:
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: Create mount_info dictionary variable'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - '{{ device_name.stdout_lines[0].split() | list | lower }}'
  - '{{ device_name.stdout_lines[1].split() | list }}'
  when:
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length > 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: If /opt not mounted, craft mount_info manually'
  set_fact:
    mount_info: '{{ mount_info|default({})|combine({item.0: item.1}) }}'
  with_together:
  - - target
    - source
    - fstype
    - options
  - - /opt
    - ''
    - ''
    - defaults
  when:
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - ("--fstab" | length == 0)
  - device_name.stdout is defined and device_name.stdout_lines is defined
  - (device_name.stdout | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: Make sure nosuid option is part of the to /opt
    options'
  set_fact:
    mount_info: '{{ mount_info | combine( {''options'':''''~(mount_info.options |
      default(''''))~('','' if (mount_info.options | default('''')) else '''')~''nosuid''
      }) }}'
  when:
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined and "nosuid" not in (mount_info.options | default(''))
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed

- name: 'Add nosuid Option to /opt: Ensure /opt is mounted with nosuid option'
  mount:
    path: /opt
    src: '{{ mount_info.source | default('''') }}'
    opts: '{{ mount_info.options | default('''') }}'
    state: mounted
    fstype: '{{ mount_info.fstype | default('''') }}'
  register: mount_result
  failed_when:
  - mount_result is failed
  - '''target is busy'' not in (mount_result.msg | default(''''))'
  - '''already mounted'' not in (mount_result.msg | default(''''))'
  when:
  - not ( ansible_virtualization_type in ["docker", "lxc", "openvz", "podman", "container"]
    )
  - '"/opt" in ansible_mounts | map(attribute="mount") | list'
  - mount_info is defined
  - (device_name.stdout is defined and (device_name.stdout | length > 0)) or ("--fstab"
    | length == 0)
  tags:
  - configure_strategy
  - high_disruption
  - low_complexity
  - medium_severity
  - mount_option_opt_nosuid
  - no_reboot_needed
