Use template to generate modprobe settings

ansible/playbooks/tasks/harden.yml

@@ -207,15 +207,12 @@
         - efi
 
     - name: disable unused filesystems
-      lineinfile:
+      template:
+        src: "etc/modprobe.d/cis.conf.j2"
         dest: "/etc/modprobe.d/cis.conf"
-        owner: root
+        owner: 'root'
-        group: root
+        group: 'root'
         mode: '0644'
-        line: "install {{ item }} /bin/true"
-        state: present
-        create: true
-      with_items: "{{ modprobe_unused_filesystems }}"
       tags:
         - harden
 

ansible/playbooks/templates/etc/modprobe.d/cis.conf.j2

@@ -0,0 +1,4 @@
+# Generated by Ansible
+{% for fs in modprobe_unused_filesystems %}
+install {{ fs }} /bin/true
+{% endfor %}