Removal of core dump hardening configuration if core dumps are allowed

[martinbydefault]

Implemented changes proposed in issue #129 and some other fixes.

• Grouped tasks with same conditional inside a block and mantained the create limits.d-directory if it does not exist task because pam_limits module doesn't work if the dest parameters has a path with a non-existent directory (https://github.com/ansible/ansible/blob/stable-2.4/lib/ansible/modules/system/pam_limits.py#L171-L180)
• Deleted /etc/security/limits.d/10.hardcore.conf and /etc/profile.d/pinerolo_profile.sh when variable os_security_kernel_enable_core_dump is True
• Fixed this when clause (https://github.com/dev-sec/ansible-os-hardening/blob/master/tasks/limits.yml) the condition should be negated, see:
  • https://github.com/dev-sec/puppet-os-hardening/pull/91/files
  • https://github.com/dev-sec/ansible-os-hardening/blob/3cb86a6202934ae62a09426efc35497e760dd08a/tasks/profile.yml#L9

[rndmh3ro]

Seems like we're hitting a bug in ansible here, the fix is merged, but not yet released.

Do you need this PR merged? Else I'd say we wait for a bugfix-release of ansible.

[martinbydefault]

I agree to wait for the release with the bugfix.
But looking at the merge commit, it looks like the fix was already realeased with ansible 2.4 (ansible/ansible@94707d0).
I don't know how to check, but maybe the Travis CI build is using ansible 2.3 instead of 2.4?

[rndmh3ro]

You're right. In epel, which centos uses, Ansible is still in version 2.3. I hope it won't stay that way for long.