|
 |
dac76a |
From b87b0e68c3c0cfb9439f8b9b5bb1c553d1a53de0 Mon Sep 17 00:00:00 2001
|
|
|
dac76a |
From: Vojtech Polasek <vpolasek@redhat.com>
|
|
|
dac76a |
Date: Tue, 28 Apr 2020 17:10:25 +0200
|
|
|
dac76a |
Subject: [PATCH] fix regex and remove recurse from tasks
|
|
|
dac76a |
|
|
|
dac76a |
---
|
|
|
dac76a |
shared/macros-ansible.jinja | 5 ++---
|
|
|
dac76a |
1 file changed, 2 insertions(+), 3 deletions(-)
|
|
|
dac76a |
|
|
|
dac76a |
diff --git a/shared/macros-ansible.jinja b/shared/macros-ansible.jinja
|
|
|
dac76a |
index 884b562ae4..92ee35e08c 100644
|
|
|
dac76a |
--- a/shared/macros-ansible.jinja
|
|
|
dac76a |
+++ b/shared/macros-ansible.jinja
|
|
|
dac76a |
@@ -277,6 +277,7 @@ regex_replace("\(n\)\*", "\\n")
|
|
|
dac76a |
{{% macro ansible_deregexify_banner_backslash() -%}}
|
|
|
dac76a |
regex_replace("\\", "")
|
|
|
dac76a |
{{%- endmacro %}}
|
|
|
dac76a |
+
|
|
|
dac76a |
{{#
|
|
|
dac76a |
The following macro remediates one audit watch rule in /etc/audit/rules.d directory.
|
|
|
dac76a |
The macro requires following parameters:
|
|
|
dac76a |
@@ -289,7 +290,6 @@ in some file within /etc/audit/rules.d/, the new rule will be appended to this f
|
|
|
dac76a |
- name: Check if watch rule for {{{ path }}} already exists in /etc/audit/rules.d/
|
|
|
dac76a |
find:
|
|
|
dac76a |
paths: "/etc/audit/rules.d"
|
|
|
dac76a |
- recurse: no
|
|
|
dac76a |
contains: '^\s*-w\s+{{{ path }}}\s+-p\s+{{{ permissions }}}(\s|$)+'
|
|
|
dac76a |
patterns: "*.rules"
|
|
|
dac76a |
register: find_existing_watch_rules_d
|
|
|
dac76a |
@@ -297,8 +297,7 @@ in some file within /etc/audit/rules.d/, the new rule will be appended to this f
|
|
|
dac76a |
- name: Search /etc/audit/rules.d for other rules with specified key {{{ key }}}
|
|
|
dac76a |
find:
|
|
|
dac76a |
paths: "/etc/audit/rules.d"
|
|
|
dac76a |
- recurse: no
|
|
|
dac76a |
- contains: "^.*(-F key=)(|-k ){{{ key }}}$"
|
|
|
dac76a |
+ contains: '^.*(?:-F key=|-k\s+){{{ key }}}$'
|
|
|
dac76a |
patterns: "*.rules"
|
|
|
dac76a |
register: find_watch_key
|
|
|
dac76a |
when: find_existing_watch_rules_d.matched is defined and find_existing_watch_rules_d.matched == 0
|