# platform = multi_platform_ol,multi_platform_rhv,multi_platform_fedora,multi_platform_almalinux,multi_platform_rhel
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low

- name: "{{{ rule_title }}} - Ensure polkit-pkla-compat is installed"
  ansible.builtin.package:
    name: "polkit-pkla-compat"
    state: present

- name: "{{{ rule_title }}} - Ensure non-privileged users do not have access to nmcli"
  community.general.ini_file:
    path: /etc/polkit-1/localauthority/20-org.d/10-nm-harden-access.pkla
    section: Disable General User Access to NetworkManager
    option: "{{ item.option }}"
    value: "{{ item.value }}"
    no_extra_spaces: yes
    create: yes
  loop:
    - { option: 'Identity', value: 'default' }
    - { option: 'Action', value: 'org.freedesktop.NetworkManager.*' }
    - { option: 'ResultAny', value: 'no' }
    - { option: 'ResultInactive', value: 'no' }
    - { option: 'ResultActive', value: 'auth_admin' }
