diff --git a/roles/debian/rkhunter/tasks/main.yml b/roles/debian/rkhunter/tasks/main.yml index 336dcff92..9825b0606 100644 --- a/roles/debian/rkhunter/tasks/main.yml +++ b/roles/debian/rkhunter/tasks/main.yml @@ -7,6 +7,18 @@ cache_valid_time: 240 notify: Update rkhunter +- name: Check paths for script existence + ansible.builtin.stat: + path: "{{ item }}" + register: _rkhunter_existing_scripts_to_whitelist + loop: "{{ rkhunter.scriptwhitelist }}" + +- name: Filter existing scripts + set_fact: + existing_scripts: "{{ existing_scripts | default([]) + [item.item] }}" + when: item.stat.exists + loop: "{{ _rkhunter_existing_scripts_to_whitelist.results }}" + - name: Copy rkhunter configuration. ansible.builtin.template: src: rkhunter.conf.j2 @@ -30,4 +42,4 @@ _overrides: "{{ rkhunter.overrides }}" when: - rkhunter.overrides is defined - - rkhunter.overrides | length > 0 \ No newline at end of file + - rkhunter.overrides | length > 0 diff --git a/roles/debian/rkhunter/templates/rkhunter.conf.j2 b/roles/debian/rkhunter/templates/rkhunter.conf.j2 index e5ffc1af6..b9e3468a7 100644 --- a/roles/debian/rkhunter/templates/rkhunter.conf.j2 +++ b/roles/debian/rkhunter/templates/rkhunter.conf.j2 @@ -585,9 +585,11 @@ PKGMGR={{ rkhunter.os_package_manager }} # # The default value is the null string. # -{% for item in rkhunter.scriptwhitelist %} +{% if existing_scripts is defined and existing_scripts | length > 0 %} +{% for item in existing_scripts %} SCRIPTWHITELIST={{ item }} {% endfor %} +{% endif %} # # Allow the specified file to have the immutable attribute set.