macros-ansible.jinja

{{#
Pass strings that correspond to XCCDF value names as arguments to this macro:
ansible_instantiate_variables("varname1", "varname2")

Then, assume that the task that follows can work with the variable by referencing it, e.g.
value: "Setting={{ varname1 }}"

#}}
{{%- macro ansible_instantiate_variables() -%}}
{{%- for name in varargs -%}}
- (xccdf-var {{{ name }}})
{{% endfor -%}}
{{%- endmacro -%}}

{{#
  A wrapper over the Ansible lineinfile module. This handles the most common
  options for us. regex is optional and when blank, it won't be included in
  the Ansible script; this allows arbitrary additions to files. new_line will
  only be passed when state is present. with_items will be specified only if
  non-empty, allowing for iterating through a variable of content (with the
  appropriate macro-based path). register will be specified only if non-empty,
  allowing for saving the output of this lineinfile module. check_mode allows
  an idempotent way to gather output, or run a task without changes. Useful when
  calling the ansible_only_lineinfile macro to handle deduplication of values.

  Note that all string-like parameters are single quoted in the YAML.
#}}
{{%- macro ansible_lineinfile(msg='', path='', regex='', new_line='', create='no', state='present', with_items='', register='', when='', validate='', insert_after='', insert_before='', check_mode=False) -%}}
- name: "{{{ msg or rule_title }}}"
  lineinfile:
    path: '{{{ path }}}'
    create: {{{ create }}}
    {{%- if regex %}}
    regexp: '{{{ regex }}}'
    {{%- endif %}}
    {{%- if state == 'present' %}}
    line: '{{{ new_line }}}'
    state: present
    {{%- if insert_after %}}
    insertafter: '{{{ insert_after }}}'
    {{%- elif insert_before %}}
    insertbefore: '{{{ insert_before }}}'
    {{%- endif %}}
    {{%- else %}}
    state: '{{{ state }}}'
    {{%- endif %}}
    {{%- if validate %}}
    validate: '{{{ validate }}}'
    {{%- endif %}}
  {{%- if with_items %}}
  with_items: '{{{ with_items }}}'
  {{%- endif %}}
  {{%- if check_mode %}}
  check_mode: yes
  changed_when: no
  {{%- endif %}}
  {{%- if register %}}
  register: '{{{ register }}}'
  {{%- endif %}}
  {{%- if when %}}
  when: '{{{ when }}}'
  {{%- endif %}}
{{%- endmacro %}}

{{#
  Check the file system status of an object. Not a full implementation.
#}}
{{%- macro ansible_stat(msg='', path='', register='') %}}
- name: '{{{ msg or rule_title }}}'
  stat:
    path: '{{{ path }}}'
  {{%- if register %}}
  register: '{{{ register }}}'
  {{%- endif %}}
{{%- endmacro %}}

{{#
  Find files matching a particular value. Not a full implementation.
#}}
{{%- macro ansible_find(msg='', paths='', recurse='yes', follow='no', contains='', register='', when='') %}}
- name: '{{{ msg or rule_title }}}'
  find:
    paths: '{{{ paths }}}'
    recurse: '{{{ recurse }}}'
    follow: '{{{ follow }}}'
    {{%- if contains %}}
    contains: '{{{ contains }}}'
    {{%- endif %}}
  {{%- if register %}}
  register: '{{{ register }}}'
  {{%- endif %}}
  {{%- if when %}}
  when: '{{{ when }}}'
  {{%- endif %}}
{{%- endmacro %}}

{{#
  A wrapper for adding one, unique line to a file. A regex must be specified
  to tell if the line is unique. This is helpful in configuration files where
  a single configuration parameter might have multiple values, but only one
  value is approved. All lines matching the regex are first removed and then
  the new line is appended to the file.
#}}
{{%- macro ansible_only_lineinfile(msg, path, line_regex, new_line, create='no', block=False, validate='', insert_after='', insert_before='') -%}}
{{%- if block %}}
- name: "{{{ msg or rule_title }}}"
  block:
    {{{ ansible_lineinfile("Check for duplicate values", path, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True)|indent }}}
    {{{ ansible_lineinfile("Deduplicate values from " + path, path, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1')|indent }}}
    {{{ ansible_lineinfile("Insert correct line to " + path, path, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before)|indent }}}
{{%- else %}}
{{{ ansible_lineinfile("Check for duplicate values", path, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True) }}}
{{{ ansible_lineinfile("Deduplicate values from " + path, path, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1') }}}
{{{ ansible_lineinfile("Insert correct line into " + path, path, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before) }}}
{{%- endif %}}
{{%- endmacro %}}

{{#
  Ensure the configuration is set in a file. Note this handles generic
  key-seperator-value files with no sense of structure. In particular,
  ini configuration files are best served with the ini Ansible module
  instead of lineinfile-based solutions.
#}}
{{%- macro ansible_set_config_file(msg, file, parameter, separator=' ', separator_regex='\s+', value='', prefix_regex='^\s*', create='no', validate='', insert_after='', insert_before='') %}}
{{{ ansible_only_lineinfile(msg, file, prefix_regex + parameter + separator_regex, parameter + separator + value, create=create, block=True, validate=validate, insert_after=insert_after, insert_before=insert_before) }}}
{{%- endmacro %}}

{{#
  Ensure the configuration is set in a file and not conflicted by a
  configuration in a directory. Note this handles generic key-separator-value
  files with no sense of structure. In particular, ini configuration files are
  best served with the ini Ansible module instead of lineinfile-based
  solutions.
#}}
{{%- macro ansible_set_config_file_dir(msg, config_file, config_dir, set_file, parameter, separator=' ', separator_regex='\s+', value='', prefix_regex='^\s*', create='no', validate='', insert_after='', insert_before='') %}}
{{%- set var_dir = config_dir | replace("/", "_") | replace("-", "_") | replace(".", "_") -%}}
{{%- set dir_exists = var_dir + "_exists" -%}}
{{%- set dir_parameter = var_dir + "_has_parameter" -%}}
{{%- set line_regex = prefix_regex + parameter + separator_regex -%}}
{{%- set find_when = dir_exists + ".stat.isdir is defined and " + dir_exists + ".stat.isdir" -%}}
{{%- set lineinfile_items = "{{ " + dir_parameter + ".files }}" -%}}
{{%- set lineinfile_when = dir_parameter + ".matched" -%}}
{{%- set new_line = parameter + separator + value -%}}
- name: '{{{ msg or rule_title }}}'
  block:
    {{{ ansible_lineinfile("Check for duplicate values", config_file, regex=line_regex, create='no', state='absent', register='dupes', check_mode=True)|indent }}}
    {{{ ansible_lineinfile("Deduplicate values from " + config_file, config_file, regex=line_regex, create='no', state='absent', when='dupes.found is defined and dupes.found > 1')|indent }}}
    {{{ ansible_stat("Check if " + config_dir + " exists", path=config_dir, register=dir_exists)|indent }}}
    {{{ ansible_find("Check if the parameter " + parameter + " is present in " + config_dir, paths=config_dir, contains=line_regex, register=dir_parameter, when=find_when)|indent }}}
    {{{ ansible_lineinfile("Remove parameter from files in " + config_dir, path="{{ item.path }}", regex=line_regex, state="absent", with_items=lineinfile_items, when=lineinfile_when)|indent }}}
    {{{ ansible_lineinfile("Insert correct line to " + set_file, set_file, regex=line_regex, new_line=new_line, create=create, state='present', validate=validate, insert_after=insert_after, insert_before=insert_before)|indent }}}
{{%- endmacro %}}

{{#
  High level macro to set a value in the ssh daemon configuration file. This
  takes three values: msg (the name for the Ansible task), a parameter to set
  in the configuration file, and the value to set it to. We specify a case
  insensitive comparison in the prefix since this is used to deduplicate since
  sshd_config has case-insensitive parameters (but case-sensitive values).
  We also specify the validation program here; -t specifies test and -f allows
  Ansible to pass a file at a different path.
#}}
{{%- macro ansible_sshd_set(msg='', parameter='', value='') %}}
{{{ ansible_set_config_file(msg, "/etc/ssh/sshd_config", parameter, value=value, create="yes", prefix_regex='(?i)^\s*', validate="/usr/sbin/sshd -t -f %s", insert_before="^[#\s]*Match") }}}
{{%- endmacro %}}

{{#
  High level macro to set a value in a shell-related file that contains var assignments. This
  takes these values:
  - msg (the name for the Ansible task),
  - path to the file,
  - parameter to set in the configuration file, and
  - value to set it to.
  We also specify the validation program here; see 'bash -c "help set" | grep -e -n'
#}}
{{%- macro ansible_shell_set(msg, path, parameter, value='', no_quotes=false) %}}
{{% if no_quotes -%}}
{{%- else -%}}
{{# Use the double quotes in all cases, as the underlying macro single-quotes the assignment line. #}}
{{% set value = '"%s"' % value %}}
{{%- endif -%}}
{{{ ansible_set_config_file(msg, path, parameter, separator="=", separator_regex="=", value=value, create="yes", prefix_regex='^\s*', validate="/usr/bin/bash -n %s", insert_before="^# " ~ parameter) }}}
{{%- endmacro %}}

{{#
  High level macro to set a command in tmux configuration file /etc/tmux.conf.
  Parameters:
  - msg: the name for the Ansible task
  - parameter: parameter to be set in the configuration file
  - value: value of the parameter
  Automatically adds "set -g " before the parameter.
#}}
{{%- macro ansible_tmux_set(msg='', parameter='', value='') %}}
{{{ ansible_set_config_file(msg, "/etc/tmux.conf", "set -g " + parameter, value=value, create="yes") }}}
{{%- endmacro %}}

{{#
  High level macro to set a value in /etc/profile (and /etc/profile.d) bash
  files. Note this is only suitable for calling a single command once with the
  correct arguments and not for calling the same command multiple times with
  different arguments. This includes setting an environment variable once.
#}}
{{%- macro ansible_etc_profile_set(msg='', parameter='', value='') %}}
{{{ ansible_set_config_file_dir(msg, "/etc/profile", "/etc/profile.d", "/etc/profile", parameter, separator='=', separator_regex='=', value=value, create='yes', validate="bash -n %s") }}}
{{%- endmacro %}}

{{#
  High level macro to set a command in auditd configuration file /etc/audit/auditd.conf.
  Parameters:
  - msg: the name for the Ansible task
  - parameter: parameter to be set in the configuration file
  - value: value of the parameter
#}}
{{%- macro ansible_auditd_set(msg='', parameter='', value='') %}}
{{{ ansible_set_config_file(msg, "/etc/audit/auditd.conf", parameter=parameter, value=value, create="yes", prefix_regex='(?i)^\s*', separator=" = ", separator_regex="\s*=\s*") }}}
{{%- endmacro %}}

{{#
  High level macro to set a parameter in /etc/systemd/coredump.conf.
  Parameters:
  - msg: the name for the Ansible task
  - parameter: parameter to be set in the configuration file
  - value: value of the parameter
#}}
{{%- macro ansible_coredump_config_set(msg='', parameter='', value='') %}}
{{{ ansible_set_config_file(msg, "/etc/systemd/coredump.conf", parameter=parameter, value=value, create="no", separator="=", separator_regex="\s*=\s*") }}}
{{%- endmacro %}}

{{#
  High level macro to set a parameter in /etc/selinux/config.
  Parameters:
  - msg: the name for the Ansible task
  - parameter: parameter to be set in the configuration file
  - value: value of the parameter
#}}
{{%- macro ansible_selinux_config_set(msg='', parameter='', value='') %}}
{{{ ansible_set_config_file(msg, "/etc/selinux/config", parameter=parameter, value=value, create="yes", separator="=", separator_regex="=", prefix_regex='^') }}}
{{%- endmacro %}}

{{#
  Generates an Ansible task that puts 'contents' into a file at 'filepath'
  Parameters:
    - filepath - filepath of the file to check
    - contents - contents that should be in the file
#}}
{{%- macro ansible_file_contents(filepath='', contents='') %}}
- name: "Put contents into {{{ filepath }}} according to policy"
  copy:
    dest: "{{{ filepath }}}"
    content: |+
        {{{ contents|trim()|indent(8) }}}
    force: yes
{{%- endmacro %}}

{{#
  Formats a banner regex for use in /etc/issue
  Parameters:
    - banner_var_name - name of ansible variable with the banner regex
#}}
{{% macro ansible_deregexify_banner_etc_issue(banner_var_name) -%}}
{{ {{{ banner_var_name }}} |
{{{ ansible_deregexify_banner_anchors() }}} |
{{{ ansible_deregexify_multiple_banners() }}} |
{{{ ansible_deregexify_banner_space() }}} |
{{{ ansible_deregexify_banner_newline("\\n") }}} |
{{{ ansible_deregexify_banner_backslash() }}} |
wordwrap() }}
{{%- endmacro %}}

{{#
  Formats a banner regex for use in dconf
  Parameters:
    - banner_var_name - name of ansible variable with the banner regex
#}}
{{% macro ansible_deregexify_banner_dconf_gnome(banner_var_name) -%}}
''{{ {{{ banner_var_name }}} |
{{{ ansible_deregexify_banner_anchors() }}} |
{{{ ansible_deregexify_multiple_banners() }}} |
{{{ ansible_deregexify_banner_space() }}} |
{{{ ansible_deregexify_banner_newline("(n)*") }}} |
{{{ ansible_deregexify_banner_backslash() }}} |
{{{ ansible_deregexify_banner_newline_token()}}} }}''
{{%- endmacro %}}

{{# Strips anchors around the banner #}}
{{% macro ansible_deregexify_banner_anchors() -%}}
regex_replace("^\^(.*)\$$", "\1")
{{%- endmacro %}}

{{# Strips multibanner regex and keeps only the first banner #}}
{{% macro ansible_deregexify_multiple_banners() -%}}
regex_replace("^\((.*)\|.*\)$", "\1")
{{%- endmacro %}}

{{# Strips whitespace or newline regex #}}
{{% macro ansible_deregexify_banner_space() -%}}
regex_replace("\[\\s\\n\]\+"," ")
{{%- endmacro %}}

{{# Strips newline or newline escape sequence regex #}}
{{% macro ansible_deregexify_banner_newline(newline) -%}}
regex_replace("\(\?:\[\\n\]\+\|\(\?:\\\\n\)\+\)", "{{{ newline }}}")
{{%- endmacro %}}

{{# Strips newline token for a newline escape sequence regex #}}
{{% macro ansible_deregexify_banner_newline_token() -%}}
regex_replace("\(n\)\*", "\\n")
{{%- endmacro %}}

{{# Strips backslash regex #}}
{{% macro ansible_deregexify_banner_backslash() -%}}
regex_replace("\\", "")
{{%- endmacro %}}

{{#
The following macro remediates one audit watch rule in /etc/audit/rules.d directory.
The macro requires following parameters:
- path: path to watch
- permissions: permissions changes to watch for
- key: key to use as identifier. Note that if there exists any other rule with the same find_mac_key
in some file within /etc/audit/rules.d/, the new rule will be appended to this file.
#}}
{{% macro ansible_audit_augenrules_add_watch_rule(path='', permissions='', key='') -%}}
- name: Check if watch rule for {{{ path }}} already exists in /etc/audit/rules.d/
  find:
    paths: "/etc/audit/rules.d"
    contains: '^\s*-w\s+{{{ path }}}\s+-p\s+{{{ permissions }}}(\s|$)+'
    patterns: "*.rules"
  register: find_existing_watch_rules_d

- name: Search /etc/audit/rules.d for other rules with specified key {{{ key }}}
  find:
    paths: "/etc/audit/rules.d"
    contains: '^.*(?:-F key=|-k\s+){{{ key }}}$'
    patterns: "*.rules"
  register: find_watch_key
  when: find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Use /etc/audit/rules.d/{{{ key }}}.rules as the recipient for the rule
  set_fact:
    all_files:
      - /etc/audit/rules.d/{{{ key }}}.rules
  when: find_watch_key.matched is defined and find_watch_key.matched == 0 and find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Use matched file as the recipient for the rule
  set_fact:
    all_files:
      - "{{ find_watch_key.files | map(attribute='path') | list | first }}"
  when: find_watch_key.matched is defined and find_watch_key.matched > 0 and find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0

- name: Add watch rule for {{{ path }}} in /etc/audit/rules.d/
  lineinfile:
    path: "{{ all_files[0] }}"
    line: "-w {{{ path }}} -p {{{ permissions }}} -k {{{ key }}}"
    create: yes
    mode: '0640'
  when: find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0
{{%- endmacro %}}

{{#
The following macro remediates one audit watch rule in /etc/audit/audit.rules.
The macro requires following parameters:
- path: path to watch
- permissions: permissions changes to watch for
- key: key to use as identifier
#}}
{{% macro ansible_audit_auditctl_add_watch_rule(path='', permissions='', key='') -%}}
- name: Check if watch rule for {{{ path }}} already exists in /etc/audit/audit.rules
  find:
    paths: "/etc/audit/"
    contains: '^\s*-w\s+{{{ path }}}\s+-p\s+{{{ permissions }}}(\s|$)+'
    patterns: "audit.rules"
  register: find_existing_watch_audit_rules

- name: Add watch rule for {{{ path }}} in /etc/audit/audit.rules
  lineinfile:
    line: "-w {{{ path }}} -p {{{ permissions }}} -k {{{ key }}}"
    state: present
    dest: /etc/audit/audit.rules
    create: yes
    mode: '0640'
  when: find_existing_watch_audit_rules.matched is defined and find_existing_watch_audit_rules.matched == 0
{{%- endmacro %}}

{{#
The following macro remediates Audit syscall rule in /etc/audit/rules.d directory.
The macro requires following parameters:
- action_arch_filters:  The action and arch filters of the rule
                        For example, "-a always,exit -F arch=b64"
- other_filters:        Other filters that may characterize the rule:
                        For example, "-F a2&03 -F path=/etc/passwd"
- auid_filters:         The auid filters of the rule
                        For example, "-F auid>=1000 -F auid!=unset"
- syscalls:             List of syscalls to ensure presense among audit rules
                        For example, "['fchown', 'lchown', 'fchownat']"
- syscall_groupings:    List of other syscalls that can be grouped with 'syscalls'
                        For example, "['fchown', 'lchown', 'fchownat']"
- key:                  The key to use when appending a new rule
#}}
{{% macro ansible_audit_augenrules_add_syscall_rule(action_arch_filters="", other_filters="", auid_filters="", syscalls=[], key="", syscall_grouping=[]) -%}}
{{% if other_filters != "" %}}
    {{% set other_filters = " " ~ other_filters %}}
{{% endif %}}
{{% if auid_filters != "" %}}
    {{% set auid_filters = " " ~ auid_filters %}}
{{% endif %}}
{{% if syscalls == [] %}}
    {{% set syscall_flag = "" %}}
{{% else %}}
    {{% set syscall_flag = " -S " %}}
{{% endif %}}
- name: Declare list of syscalls
  set_fact:
    syscalls: {{{ syscalls }}}
    syscall_grouping: {{{ syscall_grouping }}}

- name: Check existence of {{{ syscalls | join(", ") }}} in /etc/audit/rules.d/
  find:
    paths: /etc/audit/rules.d
    contains: '{{{ action_arch_filters }}}(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*{{{ other_filters }}}{{{ auid_filters }}} (-k\s+|-F\s+key=)\S+\s*$'
    patterns: '*.rules'
  register: find_command
  loop: '{{ (syscall_grouping + syscalls) | unique }}'

- name: Reset syscalls found per file
  set_fact:
    syscalls_per_file: {}
    found_paths_dict: {}

- name: Declare syscalls found per file
  set_fact: syscalls_per_file="{{ syscalls_per_file | combine( {item.files[0].path :[item.item] + syscalls_per_file.get(item.files[0].path, []) } ) }}"
  loop: "{{ find_command.results | selectattr('matched') | list}}"

- name: Declare files where syscalls where found
  set_fact: found_paths="{{ find_command.results | map(attribute='files') | flatten | map(attribute='path') | list }}"

- name: Count occurrences of syscalls in paths
  set_fact: found_paths_dict="{{ found_paths_dict | combine({ item:1+found_paths_dict.get(item, 0) }) }}"
  loop: "{{ find_command.results | map(attribute='files') | flatten | map(attribute='path') | list }}"

- name: Get path with most syscalls
  set_fact: audit_file="{{ (found_paths_dict | dict2items() | sort(attribute='value') | last).key }}"
  when: found_paths | length >= 1

- name: No file with syscall found, set path to /etc/audit/rules.d/{{{ key }}}.rules
  set_fact: audit_file="/etc/audit/rules.d/{{{ key }}}.rules"
  when: found_paths | length == 0

- name: Declare found syscalls
  set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item') | list }}"

- name: Declare missing syscalls
  set_fact:
    missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

- name: Replace the audit rule in {{ audit_file }}
  lineinfile:
    path: '{{ audit_file }}'
    regexp: '({{{ action_arch_filters }}})(?=.*(?:(?:-S |,)(?:{{ syscalls_per_file[audit_file] | join("|") }}))\b)((?:( -S |,)\w+)+)({{{ other_filters }}}{{{ auid_filters }}} (?:-k |-F key=)\w+)'
    line: '\1\2\3{{ missing_syscalls | join("\3") }}\4'
    backrefs: yes
    state: present
  when: syscalls_found | length > 0 and missing_syscalls | length > 0

- name: Add the audit rule to {{ audit_file }}
  lineinfile:
    path: '{{ audit_file }}'
    line: "{{{ action_arch_filters }}}{{{ syscall_flag }}}{{ syscalls | join(',') }}{{{ other_filters }}}{{{ auid_filters}}} -F key={{{ key }}}"
    create: true
    mode: 0640
    state: present
  when: syscalls_found | length == 0
{{%- endmacro %}}

{{#
The following macro remediates Audit syscall rule in /etc/audit/audit.rules file.
The macro requires following parameters:
- action_arch_filters:  The action and arch filters of the rule
                        For example, "-a always,exit -F arch=b64"
- other_filters:        Other filters that may characterize the rule:
                        For example, "-F a2&03 -F path=/etc/passwd"
- auid_filters:         The auid filters of the rule
                        For example, "-F auid>=1000 -F auid!=unset"
- syscalls:             List of syscalls to ensure presense among audit rules
                        For example, "['fchown', 'lchown', 'fchownat']"
- syscall_groupings:    List of other syscalls that can be grouped with 'syscalls'
                        For example, "['fchown', 'lchown', 'fchownat']"
- key:                  The key to use when appending a new rule
#}}
{{% macro ansible_audit_auditctl_add_syscall_rule(action_arch_filters="", other_filters="", auid_filters="", syscalls=[], key="", syscall_grouping=[]) -%}}
{{% if other_filters!= "" %}}
    {{% set other_filters = " " ~ other_filters %}}
{{% endif %}}
{{% if auid_filters!= "" %}}
    {{% set auid_filters = " " ~ auid_filters %}}
{{% endif %}}
{{% if syscalls == [] %}}
    {{% set syscall_flag = "" %}}
{{% else %}}
    {{% set syscall_flag = " -S " %}}
{{% endif %}}
- name: Declare list of syscalls
  set_fact:
    syscalls: {{{ syscalls }}}
    syscall_grouping: {{{ syscall_grouping }}}

- name: Check existence of {{{ syscalls | join(", ") }}} in /etc/audit/audit.rules
  find:
    paths: /etc/audit
    contains: '{{{ action_arch_filters }}}(( -S |,)\w+)*(( -S |,){{ item }})+(( -S |,)\w+)*{{{ other_filters }}}{{{ auid_filters }}} (-k\s+|-F\s+key=)\S+\s*$'
    patterns: 'audit.rules'
  register: find_command
  loop: '{{ (syscall_grouping + syscalls) | unique }}'

- name: Set path to /etc/audit/audit.rules
  set_fact: audit_file="/etc/audit/audit.rules"

- name: Declare found syscalls
  set_fact: syscalls_found="{{ find_command.results | selectattr('matched') | map(attribute='item') | list }}"

- name: Declare missing syscalls
  set_fact:
    missing_syscalls="{{ syscalls | difference(syscalls_found) }}"

- name: Replace the audit rule in {{ audit_file }}
  lineinfile:
    path: '{{ audit_file }}'
    regexp: '({{{ action_arch_filters }}})(?=.*(?:(?:-S |,)(?:{{ syscalls_found | join("|") }}))\b)((?:( -S |,)\w+)+)({{{ other_filters }}}{{{ auid_filters }}} (?:-k |-F key=)\w+)'
    line: '\1\2\3{{ missing_syscalls | join("\3") }}\4'
    backrefs: yes
    state: present
  when: syscalls_found | length > 0 and missing_syscalls | length > 0

- name: Add the audit rule to {{ audit_file }}
  lineinfile:
    path: '{{ audit_file }}'
    line: "{{{ action_arch_filters }}}{{{ syscall_flag }}}{{ syscalls | join(',') }}{{{ other_filters }}}{{{ auid_filters}}} -F key={{{ key }}}"
    create: true
    state: present
  when: syscalls_found | length == 0
{{%- endmacro %}}

{{% macro ansible_sssd_ldap_config(parameter, value) -%}}
- name: "Test for id_provider different than Active Directory (ad)"
  command: grep -qzosP '[[:space:]]*\[domain\/[^]]*]([^(\n)]*(\n)+)+?[[:space:]]*id_provider[[:space:]]*=[[:space:]]*((?i)ad)[[:space:]]*$' /etc/sssd/sssd.conf
  register: test_id_provider
  ignore_errors: yes
  changed_when: False
  check_mode: no

- name: "Test for domain group"
  command: grep '\s*\[domain\/[^]]*]' /etc/sssd/sssd.conf
  register: test_grep_domain
  ignore_errors: yes
  changed_when: False
  check_mode: no

- name: "Add default domain group and set {{{ parameter }}} in sssd configuration (if no domain there)"
  ini_file:
    path: /etc/sssd/sssd.conf
    section: "{{ item.section }}"
    option: "{{ item.option }}"
    value: "{{ item.value }}"
  with_items:
    - { section: sssd, option: domains, value: default}
    - { section: domain/default, option: {{{ parameter }}}, value: "{{{ value }}}"}
  when:
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length < 1
    - test_id_provider.stdout is defined
    - test_id_provider.stdout | length < 1

- name: "Set {{{ parameter }}} in sssd configuration"
  ini_file:
    path: /etc/sssd/sssd.conf
    section: "{{ test_grep_domain.stdout | regex_replace('\\[(.*)\\]','\\1') }}"
    option: {{{ parameter }}}
    value: "{{{ value }}}"
  when:
    - test_grep_domain.stdout is defined
    - test_grep_domain.stdout | length > 0
    - test_id_provider.stdout is defined
    - test_id_provider.stdout | length < 1
{{%- endmacro %}}


{{% macro ansible_ini_file_set(filename, section, key, value, description="") -%}}
- name: "{{{ description if description else ("Set '" + key + "' to '" + value + "' in the [" + section + "] section of '" + filename + "'") }}}"
  ini_file:
    path: "{{{ filename }}}"
    section: "{{{ section }}}"
    option: "{{{ key }}}"
    value: "{{{ value }}}"
    create: yes
    mode: 0644
{{%- endmacro %}}

{{%- macro ansible_sudo_remove_config(parameter, pattern) -%}}

- name: Find /etc/sudoers.d/ files
  find:
    paths:
      - /etc/sudoers.d/
  register: sudoers

- name: "Remove lines containing {{{ parameter }}} from sudoers files"
  replace:
    regexp: '(^(?!#).*[\s]+{{{ pattern }}}.*$)'
    replace: '# \g<1>'
    path: "{{ item.path }}"
    validate: /usr/sbin/visudo -cf %s
  with_items:
    - { path: /etc/sudoers }
    - "{{ sudoers.files }}"
{{%- endmacro -%}}