---

- name: "PRELIM | AUDIT | Set default values for facts"
  ansible.builtin.set_fact:
    control_1_6_1_4_was_run: false
    ubtu24cis_apparmor_enforce_only: false
  changed_when: false

- name: "PRELIM | AUDIT | Register if snap being used"
  when: ubtu24cis_rule_1_1_1_6
  tags: always
  ansible.builtin.shell: df -h | grep -wc "/snap"
  changed_when: false
  failed_when: prelim_snap_pkg_mgr.rc not in [ 0, 1 ]
  register: prelim_snap_pkg_mgr

- name: "PRELIM | AUDIT | Register if squashfs is built into the kernel"
  when: ubtu24cis_rule_1_1_1_6
  tags: always
  ansible.builtin.shell: cat /lib/modules/$(uname -r)/modules.builtin | grep -c "squashfs"
  changed_when: false
  failed_when: prelim_squashfs_builtin.rc not in [ 0, 1 ]
  register: prelim_squashfs_builtin

- name: PRELIM | AUDIT | Section 1.1 | Create list of mount points
  tags: always
  ansible.builtin.set_fact:
    prelim_mount_names: "{{ ansible_facts.mounts | map(attribute='mount') | list }}"

- name: PRELIM | AUDIT | Section 1.1 | Retrieve mount options
  tags: always
  block:
    - name: PRELIM | AUDIT | Section 1.1 | Retrieve mount options - call mount  # noqa command-instead-of-module
      ansible.builtin.shell: |
        mount | awk '{print $1, $3, $5, $6}'
      changed_when: false
      register: prelim_mount_output

    - name: PRELIM | AUDIT | Section 1.1 | Retrieve mount options - build fact
      ansible.builtin.set_fact:
        prelim_mount_point_fs_and_options: >-
          {%- set prelim_mount_point_fs_and_options = {} -%}
          {%- for line in prelim_mount_output.stdout_lines -%}
          {%- set fields = line.split() -%}
          {%- set _ = prelim_mount_point_fs_and_options.update({fields[1]: {'src': fields[0], 'fs_type': fields[2], 'original_options': fields[3][1:-1].split(','), 'options': fields[3][1:-1].split(',')}}) -%}
          {%- endfor -%}
          {{ prelim_mount_point_fs_and_options }}

    - name: "PRELIM | AUDIT | Debug of mount variables to assist in troubleshooting"
      when: ubtu24cis_debug_mount_data
      ansible.builtin.debug:
        msg: "{{ prelim_mount_point_fs_and_options }}"

- name: Include audit specific variables
  when:
    - run_audit or audit_only
    - setup_audit
  tags:
    - setup_audit
    - run_audit
  ansible.builtin.include_vars:
    file: audit.yml

- name: Include pre-remediation audit tasks
  when:
    - run_audit or audit_only
    - setup_audit
  tags:
    - run_audit
  ansible.builtin.import_tasks:
    file: pre_remediation_audit.yml

- name: "PRELIM | PATCH | Run apt update"
  when:
    - ubtu24cis_rule_1_2_1_1 or
      ubtu24cis_rule_1_2_2_1
  tags: always
  ansible.builtin.package:
    update_cache: true

- name: "PRELIM | AUDIT | Wireless adapter pre-requisites"
  when:
    - ubtu24cis_rule_3_1_2
    - not system_is_container
  tags: always
  block:
    - name: "PRELIM | AUDIT | Discover is wireless adapter on system"
      ansible.builtin.command: find /sys/class/net/*/ -type d -name wireless
      changed_when: false
      failed_when: prelim_wireless_adapters.rc not in [ 0, 1 ]
      register: prelim_wireless_adapters

    - name: "PRELIM | AUDIT | If wireless adapter present capture module"
      when: prelim_wireless_adapters.rc == 0
      ansible.builtin.shell: |
        for driverdir in $(find /sys/class/net/*/ -type d -name wireless | xargs -0 dirname);
          do basename "$(readlink -f "$driverdir"/device/driver/module)";
        done | sort -u
      changed_when: false
      failed_when: prelim_wireless_modules.rc not in [ 0, 1 ]
      register: prelim_wireless_modules

- name: "PRELIM | PATCH | Find all sudoers files."
  when:
    - ubtu24cis_rule_5_2_4 or
      ubtu24cis_rule_5_2_5
  tags: always
  ansible.builtin.shell: "find /etc/sudoers /etc/sudoers.d/ -type f ! -name '*~' ! -name '*.*'"
  changed_when: false
  failed_when: false
  check_mode: false
  register: prelim_sudoers_files

- name: "PRELIM | PATCH | Ensure conf.d directory exists required for 5.3.3.2.x"
  when:
    - ubtu24cis_rule_5_3_3_2_1 or
      ubtu24cis_rule_5_3_3_2_2 or
      ubtu24cis_rule_5_3_3_2_3 or
      ubtu24cis_rule_5_3_3_2_4 or
      ubtu24cis_rule_5_3_3_2_5 or
      ubtu24cis_rule_5_3_3_2_6
  tags: always
  ansible.builtin.file:
    path: '/etc/security/pwquality.conf.d'
    state: directory
    owner: root
    group: root
    mode: 'u+x,g-w,o-rwx'

- name: "PRELIM | AUDIT | Discover Interactive UID MIN and MIN from logins.def"
  when: not discover_int_uid
  tags: always
  block:
    - name: "PRELIM | AUDIT | Capture UID_MIN information from logins.def"
      ansible.builtin.shell: grep -w "^UID_MIN" /etc/login.defs | awk '{print $NF}'
      changed_when: false
      register: prelim_uid_min_id

    - name: "PRELIM | AUDIT | Capture UID_MAX information from logins.def"
      ansible.builtin.shell: grep -w "^UID_MAX" /etc/login.defs | awk '{print $NF}'
      changed_when: false
      register: prelim_uid_max_id

    - name: "PRELIM | AUDIT | Capture GID_MIN information from logins.def"
      ansible.builtin.shell: grep -w "^GID_MIN" /etc/login.defs | awk '{print $NF}'
      changed_when: false
      register: prelim_gid_min_id

    - name: "PRELIM | AUDIT | Set_facts for interactive uid/gid"
      ansible.builtin.set_fact:
        min_int_uid: "{{ prelim_uid_min_id.stdout }}"
        max_int_uid: "{{ prelim_uid_max_id.stdout }}"
        min_int_gid: "{{ prelim_gid_min_id.stdout }}"

- name: "PRELIM | AUDIT | Interactive Users"
  tags: always
  ansible.builtin.shell: >
    grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $1 }'
  changed_when: false
  register: prelim_interactive_usernames

- name: "PRELIM | AUDIT | Interactive User accounts home directories"
  tags: always
  ansible.builtin.shell: >
    grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false" && $7 != "/dev/null") { print $6 }'
  changed_when: false
  register: prelim_interactive_users_home

- name: "PRELIM | AUDIT | Interactive UIDs"
  tags: always
  ansible.builtin.shell: >
    grep -E -v '^(root|halt|sync|shutdown)' /etc/passwd | awk -F: '(!index($7, "sbin/nologin") && $7 != "/bin/nologin" && $7 != "/bin/false") { print $3 }'
  changed_when: false
  register: prelim_interactive_uids

- name: "PRELIM | AUDIT | Gather UID 0 accounts other than root"
  when: ubtu24cis_rule_5_4_2_1
  tags: always
  ansible.builtin.shell: "cat /etc/passwd | awk -F: '($3 == 0 && $1 != \"root\") {i++;print $1 } END {exit i}'"
  changed_when: false
  check_mode: false
  register: prelim_uid_zero_accounts_except_root

- name: "PRELIM | PATCH | Create journald conf.d directory"
  when:
    - ubtu24cis_rule_6_1_2_2 or
      ubtu24cis_rule_6_1_2_3 or
      ubtu24cis_rule_6_1_2_4
  tags: always
  ansible.builtin.file:
    path: /etc/systemd/journald.conf.d
    state: directory
    owner: root
    group: root
    mode: 'u+x,go-w'

- name: "PRELIM | PATCH | Ensure auditd is installed"
  when:
    - ubtu24cis_rule_6_2_1_1 or
      ubtu24cis_rule_6_2_4_1 or
      ubtu24cis_rule_6_2_4_6 or
      ubtu24cis_rule_6_2_4_8
  tags: always
  block:
    - name: "PRELIM | PATCH | Ensure auditd is installed"
      ansible.builtin.package:
        name: ['auditd', 'audispd-plugins']
        state: present

    - name: "PRELIM | AUDIT | Audit conf and rules files | list files"
      ansible.builtin.find:
        path: /etc/audit/
        file_type: file
        recurse: true
        patterns: '*.conf,*.rules'
      register: prelim_auditd_conf_files

- name: "PRELIM | AUDIT | Check if auditd is immutable before changes"
  when: "'auditd' in ansible_facts.packages"
  tags: always
  ansible.builtin.shell: auditctl -l | grep -c '-e 2'
  changed_when: false
  failed_when: prelim_auditd_immutable_check.rc not in [ 0, 1 ]
  register: prelim_auditd_immutable_check

- name: "PRELIM | AUDIT | 6.2.4.x | Capture information about auditd logfile path | discover file"
  when:
    - ubtu24cis_rule_6_2_4_1 or
      ubtu24cis_rule_6_2_4_2 or
      ubtu24cis_rule_6_2_4_3 or
      ubtu24cis_rule_6_2_4_4
  tags: always
  ansible.builtin.shell: "grep ^log_file /etc/audit/auditd.conf | awk '{ print $NF }'"
  changed_when: false
  failed_when: prelim_auditd_logfile.rc not in [ 0, 1 ]
  register: prelim_auditd_logfile

- name: "PRELIM | PATCH | Install ACL"
  when:
    - ubtu24cis_rule_7_2_9
    - "'acl' not in ansible_facts.packages"
  tags: always
  ansible.builtin.package:
    name: acl
    state: present

## Optional

- name: "Optional | PATCH | UFW firewall force to use /etc/sysctl.conf settings"
  when:
    - ubtu24cis_firewall_package == "ufw"
    - ubtu24cis_ufw_use_sysctl
  tags: always
  ansible.builtin.lineinfile:
    path: /etc/default/ufw
    regexp: ^IPT_SYSCTL=.*
    line: IPT_SYSCTL=/etc/sysctl.conf
    mode: 'u-x,go-wx'