# platform = multi_platform_all
# reboot = true
# strategy = restrict
# complexity = low
# disruption = low
- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield

- name: Set 32bit architecture for kernel exec-shield tasks
  ansible.builtin.set_fact:
    kexec_arch: b32
  when: ( "linux-base" in ansible_facts.packages and ansible_architecture == "x86_64"
    )
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield

- name: Set 64bit architecture for kernel exec-shield tasks
  ansible.builtin.set_fact:
    kexec_arch: b64
  when:
  - ( "linux-base" in ansible_facts.packages and ansible_architecture == "x86_64"
    )
  - ansible_architecture == "aarch64" or ansible_architecture == "ppc64" or ansible_architecture
    == "ppc64le" or ansible_architecture == "s390x" or ansible_architecture == "x86_64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield

- name: Ensure sysctl kernel.exec-shield is set to 1
  ansible.posix.sysctl:
    name: kernel.exec-shield
    value: '1'
    state: present
    reload: true
  when:
  - ( "linux-base" in ansible_facts.packages and ansible_architecture == "x86_64"
    )
  - kexec_arch == "b32"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield

- name: Check noexec argument exists
  ansible.builtin.command: grep '^GRUB_CMDLINE_LINUX=.*noexec=.*"' /etc/default/grub
  failed_when: false
  register: argcheck
  when:
  - ( "linux-base" in ansible_facts.packages and ansible_architecture == "x86_64"
    )
  - kexec_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield

- name: Replace existing noexec argument
  ansible.builtin.replace:
    path: /etc/default/grub
    regexp: \(^GRUB_CMDLINE_LINUX=".*\)noexec=?[^[:space:]]*\(.*"\)
    replace: \1 \2
  when:
  - ( "linux-base" in ansible_facts.packages and ansible_architecture == "x86_64"
    )
  - argcheck is not skipped
  - argcheck.rc == 0
  - kexec_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield

- name: Update grub defaults and the bootloader menu
  ansible.builtin.command: /sbin/grubby --update-kernel=ALL --remove-args="noexec"
  when:
  - ( "linux-base" in ansible_facts.packages and ansible_architecture == "x86_64"
    )
  - kexec_arch == "b64"
  tags:
  - NIST-800-171-3.1.7
  - NIST-800-53-CM-6(a)
  - NIST-800-53-SC-39
  - low_complexity
  - low_disruption
  - medium_severity
  - reboot_required
  - restrict_strategy
  - sysctl_kernel_exec_shield
