Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CIS Hardening tasks errors if install directory is in /opt #234

Open
Eric-Domeier opened this issue May 29, 2024 · 0 comments · May be fixed by #240
Open

CIS Hardening tasks errors if install directory is in /opt #234

Eric-Domeier opened this issue May 29, 2024 · 0 comments · May be fixed by #240

Comments

@Eric-Domeier
Copy link

Eric-Domeier commented May 29, 2024

When the install directory is /opt as it appears to be in OpenSuse, the tasks to copy the CIS Sysctl settings fail.

Needs to copy from
/opt/rke2/share/rke2/rke2-cis-sysctl.conf

The following lines from roles/rke2_common/tasks/cis-hardening.yml do not check /opt which RKE2 may be installed in

Default is /usr/local, unless /usr/local is read-only or has a dedicated mount point,
#     in which case /opt/rke2 is used instead.
 - name: Copy systemctl file for kernel hardening for yum installs
      ansible.builtin.copy:
        src: /usr/share/rke2/rke2-cis-sysctl.conf
        dest: /etc/sysctl.d/60-rke2-cis.conf
        remote_src: true
        mode: 0600
      register: sysctl_operation_yum
      when:
        - ansible_os_family == 'RedHat' or ansible_os_family == 'Rocky'
        - not rke2_binary_tarball_check.stat.exists
        - rke2_tarball_url is not defined or rke2_tarball_url == ""

    - name: Copy systemctl file for kernel hardening for non-yum installs
      ansible.builtin.copy:
        src: /usr/local/share/rke2/rke2-cis-sysctl.conf
        dest: /etc/sysctl.d/60-rke2-cis.conf
        remote_src: yes
        mode: 0600
      register: sysctl_operation_tarball
      when: >-
        (ansible_facts['os_family'] != 'RedHat' and
        ansible_facts['os_family'] != 'Rocky') or
        rke2_binary_tarball_check.stat.exists or
        (rke2_tarball_url is defined and rke2_tarball_url != "")
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant