Issue 110 and 128 Fixes

Changelog.md

@@ -1,8 +1,22 @@
 # Changes to rhel8CIS
 
+## 1.3.1
+- CIS 1.0.1 updates
+- Added Issue and PR templates
+- Added better reboot logic
+- Added options to ensure idempotence
+- Enhanced flush handlers
+- Typo fixes
+- mount check improvements
+- Linting fixes
+- Added systemd tmp mount
+- Added systemd tmpfs block
+- #110 tmp.mount support
+ - thanks to @erpadmin
+
+
 ## 1.3
 
-- CIS 1.0.1
 - extentions to LE audit capability
 - more lint and layout changes
 - sugroup assertion added 5.7

tasks/section_1/cis_1.1.x.yml

@@ -1,77 +1,64 @@
 ---
 
-- name: "1.1.2 | L1 | AUDIT | Ensure /tmp is configured"
- block:
- - name: "1.1.2 | L1 | AUDIT | Ensure /tmp is configured | Absent"
- debug:
- msg: "WARNING: {{ required_mount }} doesn't exist. This is a manual task"
- register: tmp_mount_absent
- changed_when: tmp_mount_absent.skipped is undefined
- when:
- - required_mount not in mount_names
-
- - name: "1.1.2 | L1 | AUDIT | Ensure /tmp is configured | Present"
- debug:
- msg: "Congratulations: {{ required_mount }} exists."
- register: tmp_mount_present
- when:
- - required_mount in mount_names
- vars:
- required_mount: '/tmp'
+- name: |
+ "SCORED | 1.1.2 | PATCH | Ensure /tmp is configured"
+ "SCORED | 1.1.3 | PATCH | Ensure nodev option set on /tmp partition"
+ "SCORED | 1.1.4 | PATCH | Ensure nosuid option set on /tmp partition"
+ "SCORED | 1.1.5 | PATCH | Ensure noexec option set on /tmp partition"
+ "via fstab"
+ mount:
+ name: /tmp
+ src: "{{ item.device }}"
+ fstype: "{{ item.fstype }}"
+ state: present
+ opts: defaults,{% if rhel8cis_rule_1_1_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_4 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_5 %}nosuid{% endif %}
+ notify: remount tmp
+ loop: "{{ ansible_mounts }}"
+ when:
+ - item.mount == "/tmp"
+ - not rhel8cis_tmp_svc
+ - rhel8cis_rule_1_1_2 or
+ rhel8cis_rule_1_1_3 or
+ rhel8cis_rule_1_1_4 or
+ rhel8cis_rule_1_1_5
  tags:
  - level1-server
  - level1-workstation
  - scored
- - audit
+ - patch
  - mounts
- - rule_1.1.2
+ - rule_1.1.3
+ - rule_1.1.4
+ - rule_1.1.5
 
 - name: |
- "1.1.3 | L1 | PATCH | Ensure nodev option set on /tmp partition | skips if not present"
- "1.1.4 | L1 | PATCH | Ensure nosuid option set on /tmp partition | skips if not present"
- "1.1.5 | L1 | PATCH | Ensure noexec option set on /tmp partition| skips if not present"
- block:
- - name: |
- "1.1.3 | L1 | PATCH | Ensure nodev option set on /tmp partition | fstab config | skips if mount absent"
- "1.1.4 | L1 | PATCH | Ensure nosuid option set on /tmp partition | fstab_config | skips if mount absent"
- "1.1.5 | L1 | PATCH | Ensure noexec option set on /tmp partition| fstab_config | skips if mount absent"
- mount:
- name: /tmp
- src: "{{ item.device }}"
- fstype: "{{ item.fstype }}"
- state: present
- opts: defaults,{% if rhel8cis_rule_1_1_3 %}noexec,{% endif %}{% if rhel8cis_rule_1_1_4 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_5 %}nosuid{% endif %}
- notify: remount tmp
- loop: "{{ ansible_mounts }}"
- when:
- - not rhel8cis_tmp_svc
- - item.mount == "/tmp"
-
- - name: |
- "1.1.3 | L1 | PATCH | Ensure noexec option set on /tmp partition | systemd | skips if mount absent"
- "1.1.4 | L1 | PATCH | Ensure nodev option set on /tmp partition | systemd | skips if mount absent"
- "1.1.5 | L1 | PATCH | Ensure nosuid option set on /tmp partition | systemd | skips if mount absent"
- template:
- src: etc/tmp_mount.j2
- dest: /etc/systemd/system/tmp.mount
- owner: root
- group: root
- mode: 0644
- notify: systemd restart tmp.mount
- when:
- - rhel8cis_tmp_svc
+ "SCORED | 1.1.2 | PATCH | Ensure /tmp is configured"
+ "SCORED | 1.1.3 | PATCH | Ensure nodev option set on /tmp partition"
+ "SCORED | 1.1.4 | PATCH | Ensure nosuid option set on /tmp partition"
+ "SCORED | 1.1.5 | PATCH | Ensure noexec option set on /tmp partition"
+ "via systemd"
+ template:
+ src: etc/systemd/system/tmp.mount.j2
+ dest: /etc/systemd/system/tmp.mount
+ owner: root
+ group: root
+ mode: 0644
+ notify: systemd restart tmp.mount
  when:
- - tmp_mount_present is defined
- - rhel8cis_rule_1_1_2 # This is required so the check takes place
- - rhel8cis_rule_1_1_3
- - rhel8cis_rule_1_1_4
- - rhel8cis_rule_1_1_5
+  - rhel8cis_tmp_svc
+  - rhel8cis_rule_1_1_2 or
+  rhel8cis_rule_1_1_3 or
+  rhel8cis_rule_1_1_4 or
+   rhel8cis_rule_1_1_5
  tags:
- - level1
- - patch
- - rule_1.1.3
- - rule_1.1.4
- - rule_1.1.5
+ - level1-server
+ - level1-workstation
+ - scored
+ - patch
+ - mounts
+ - rule_1.1.3
+ - rule_1.1.4
+ - rule_1.1.5
 
 - name: "1.1.6 | L2 | AUDIT | Ensure separate partition exists for /var"
  block:

tasks/section_4/cis_4.2.3.yml

@@ -1,7 +1,7 @@
 ---
 
 - name: "4.2.3 | L1 | PATCH | Ensure permissions on all logfiles are configured"
- command: find /var/log -type f -exec chmod g-wx,o-rwx {} + -o -type d -exec chmod g-w,o-rwx "{}" +
+ command: find /var/log/ -type f -perm /g+wx,o+rwx -exec chmod g-wx,o-rwx "{}" +
  changed_when: false
  failed_when: false
  when:

templates/etc/systemd/system/tmp.mount.j2

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: LGPL-2.1+
+#
+# This file is part of systemd.
+#
+# systemd is free software; you can redistribute it and/or modify it
+# under the terms of the GNU Lesser General Public License as published by
+# the Free Software Foundation; either version 2.1 of the License, or
+# (at your option) any later version.
+
+[Unit]
+Description=Temporary Directory (/tmp)
+Documentation=man:hier(7)
+Documentation=https://www.freedesktop.org/wiki/Software/systemd/APIFileSystems
+ConditionPathIsSymbolicLink=!/tmp
+DefaultDependencies=no
+Conflicts=umount.target
+Before=local-fs.target umount.target
+After=swap.target
+
+[Mount]
+What=tmpfs
+Where=/tmp
+Type=tmpfs
+Options=mode=1777,strictatime,{% if rhel8cis_rule_1_1_3 %}nodev,{% endif %}{% if rhel8cis_rule_1_1_4 %}nosuid,{% endif %}{% if rhel8cis_rule_1_1_5 %}noexec{% endif %}
+
+# Make 'systemctl enable tmp.mount' work:
+[Install]
+WantedBy=local-fs.target