ansible-hardening/tasks/boot.yml
Major Hayden 6803e42e10 Security: Check for grub.cfg first
As noted in bug 1550426, the tasks for grub.cfg will fail if
the file is not present. This patch checks for the grub.cfg
and only tries to make changes if the file is present.

Closes-bug: 1550426

Change-Id: Id5368dfa2c24d555c59f9ceef4676f3d15706ad9
2016-02-29 14:15:29 -06:00

51 lines
1.3 KiB
YAML

---
# Copyright 2015, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
- name: Check to see if grub.cfg exists
stat:
path: /boot/grub/grub.cfg
register: grub_cfg
always_run: True
- name: V-38579 - Bootloader configuration files must be owned by root
file:
path: /boot/grub/grub.cfg
owner: root
tags:
- boot
- cat2
- V-38579
when: grub_cfg.stat.exists
- name: V-38581 - Bootloader configuration files must be group-owned by root
file:
path: /boot/grub/grub.cfg
group: root
tags:
- boot
- cat2
- V-38581
when: grub_cfg.stat.exists
- name: V-38582 - Bootloader configuration files must have mode 0644 or less
file:
path: /boot/grub/grub.cfg
mode: 0644
tags:
- boot
- cat2
- V-38582
when: grub_cfg.stat.exists