Merge pull request #18 from danielkubat/harden

Use template to generate modprobe settings

ansible/playbooks/tasks/harden.yml

@@ -175,7 +175,7 @@
         dest: "/etc/audit/rules.d/collection.rules"
         owner: root
         group: root
-        mode: '600'
+        mode: '0600'
         backup: true
       notify:
         - regenerate_auditd_rules
@@ -207,15 +207,12 @@
         - efi
 
     - name: disable unused filesystems
-      lineinfile:
+      template:
+        src: "etc/modprobe.d/cis.conf.j2"
         dest: "/etc/modprobe.d/cis.conf"
-        owner: root
-        group: root
+        owner: 'root'
+        group: 'root'
         mode: '0644'
-        line: "install {{ item }} /bin/true"
-        state: present
-        create: true
-      with_items: "{{ modprobe_unused_filesystems }}"
       tags:
         - harden
 

ansible/playbooks/templates/etc/modprobe.d/cis.conf.j2

@@ -0,0 +1,4 @@
+# Generated by Ansible
+{% for fs in modprobe_unused_filesystems %}
+install {{ fs }} /bin/true
+{% endfor %}