From e14418e1bfbecde7f7091173c8ad9c84b28bd8ee Mon Sep 17 00:00:00 2001
From: Watson Sato <wsato@redhat.com>
Date: Mon, 4 May 2020 18:51:13 +0200
Subject: [PATCH] Add Ansible for kernel_module_ipv6_option_disabled

The remediation does more than disabling only one kernel module, so it
is not suitable for "templation" (use of templating system).
---
 .../ansible/shared.yml                        | 22 +++++++++++++++++++
 .../tests/module_disabled.pass.sh             |  4 ++++
 .../tests/module_enabled.fail.sh              |  4 ++++
 3 files changed, 30 insertions(+)
 create mode 100644 linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/ansible/shared.yml
 create mode 100644 linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_disabled.pass.sh
 create mode 100644 linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_enabled.fail.sh

diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/ansible/shared.yml b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/ansible/shared.yml
new file mode 100644
index 0000000000..a6d6229bdc
--- /dev/null
+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/ansible/shared.yml
@@ -0,0 +1,22 @@
+# platform = multi_platform_all
+# reboot = true
+# strategy = disable
+# complexity = low
+# disruption = medium
+
+- name: Disable IPv6 Networking kernel module
+  lineinfile:
+    create: yes
+    dest: "/etc/modprobe.d/ipv6.conf"
+    regexp: "^options\\s+ipv6\\s+disable=\\d"
+    line: "options ipv6 disable=1"
+
+- name: Ensure disable_ipv6 (all and default) is set to 1
+  sysctl:
+    name: "{{ item }}"
+    value: "1"
+    state: present
+    reload: yes
+  with_items:
+    - "net.ipv6.conf.all.disable_ipv6"
+    - "net.ipv6.conf.default.disable_ipv6"
diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_disabled.pass.sh b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_disabled.pass.sh
new file mode 100644
index 0000000000..f22b37b8e8
--- /dev/null
+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_disabled.pass.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 7
+
+echo "options ipv6 disable=1" > /etc/modprobe.d/ipv6.conf
diff --git a/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_enabled.fail.sh b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_enabled.fail.sh
new file mode 100644
index 0000000000..82122fea40
--- /dev/null
+++ b/linux_os/guide/system/network/network-ipv6/disabling_ipv6/kernel_module_ipv6_option_disabled/tests/module_enabled.fail.sh
@@ -0,0 +1,4 @@
+#!/bin/bash
+# platform = Red Hat Enterprise Linux 7
+
+echo "options ipv6 disable=0" > /etc/modprobe.d/ipv6.conf