add more conditionals to when auditd show be hardened

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>
divialth · Jul 15, 2022 · 26e37ca · 26e37ca
1 parent 862edbb
commit 26e37ca
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/roles/os_hardening/tasks/minimize_access.yml b/roles/os_hardening/tasks/minimize_access.yml
@@ -221,7 +221,10 @@
     opts: '{{ os_mnt_var_log_audit_options }}'
     state: present
   register: varlogauditmount
-  when: os_mnt_var_log_audit_enabled | bool
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
 
 - name: Harden permissions for /var/log/audit directory
   file:
@@ -230,6 +233,7 @@
     group: 'root'
     mode: '{{ os_mnt_var_log_audit_dir_mode }}'
   when:
+    - os_mnt_var_log_audit_enabled | bool
     - var_log_audit_exists.stat.exists | bool
     - os_auditd_enabled | bool