Alignment

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2023 Mindpoint Group / Lockdown Enterprise / Lockdown Enterprise Releases
+Copyright (c) 2025 Mindpoint Group - A Tyto Athene Company / Ansible Lockdown
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

tasks/post.yml

@@ -13,7 +13,7 @@
       dest: "/etc/sysctl.d/{{ item }}"
       owner: root
       group: root
-      mode: 0600
+      mode: 'u-x,go-rwx'
   register: sysctl_updated
   notify: Reload sysctl
   loop:

tasks/prelim.yml

@@ -173,7 +173,7 @@
       path: "{{ amzn2023cis_sshd_config_file }}"
       owner: root
       group: root
-      mode: '0600'
+      mode: 'u-x,o-rwx'
       state: touch
   when:
       - amzn2023cis_sshd_config_file != '/etc/ssh/sshd_config'

tasks/section_1/cis_1.1.1.x.yml

@@ -8,15 +8,15 @@
             regexp: "^(#)?install squashfs(\\s|$)"
             line: "install squashfs /bin/true"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled | blacklist"
         ansible.builtin.lineinfile:
             path: /etc/modprobe.d/blacklist.conf
             regexp: "^(#)?blacklist squashfs(\\s|$)"
             line: "blacklist squashfs"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.1 | PATCH | Ensure mounting of squashfs filesystems is disabled | Disable squashfs"
         community.general.modprobe:
@@ -41,15 +41,15 @@
             regexp: "^(#)?install udf(\\s|$)"
             line: "install udf /bin/true"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disabled | blacklist"
         ansible.builtin.lineinfile:
             path: /etc/modprobe.d/blacklist.conf
             regexp: "^(#)?blacklist udf(\\s|$)"
             line: "blacklist udf"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.2 | PATCH | Ensure mounting of udf filesystems is disable | Disable udf"
         community.general.modprobe:
@@ -72,15 +72,15 @@
             regexp: "^(#)?install cramfs(\\s|$)"
             line: "install cramfs /bin/true"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.3 | PATCH | Ensure mounting of cramfs filesystems is disabled | blacklist"
         ansible.builtin.lineinfile:
             path: /etc/modprobe.d/blacklist.conf
             regexp: "^(#)?blacklist cramfs(\\s|$)"
             line: "blacklist cramfs"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.3 | PATCH | Ensure mounting of cramfs filesystems is disable | Disable cramfs"
         community.general.modprobe:
@@ -104,15 +104,15 @@
             regexp: "^(#)?install freevxfs(\\s|$)"
             line: "install freevxfs /bin/true"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.4 | PATCH | Ensure mounting of freevxfs filesystems is disabled | blacklist"
         ansible.builtin.lineinfile:
             path: /etc/modprobe.d/blacklist.conf
             regexp: "^(#)?blacklist freevxfs(\\s|$)"
             line: "blacklist freevxfs"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.4 | PATCH | Ensure mounting of freevxfs filesystems is disable | Disable freevxfs"
         community.general.modprobe:
@@ -136,15 +136,15 @@
             regexp: "^(#)?install jffs2(\\s|$)"
             line: "install jffs2 /bin/true"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.5 | PATCH | Ensure mounting of jffs2 filesystems is disabled | blacklist"
         ansible.builtin.lineinfile:
             path: /etc/modprobe.d/blacklist.conf
             regexp: "^(#)?blacklist jffs2(\\s|$)"
             line: "blacklist jffs2"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.5 | PATCH | Ensure mounting of jffs2 filesystems is disable | Disable jffs2"
         community.general.modprobe:
@@ -168,15 +168,15 @@
             regexp: "^(#)?install hfs(\\s|$)"
             line: "install hfs /bin/true"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.6 | PATCH | Ensure mounting of hfs filesystems is disabled | blacklist"
         ansible.builtin.lineinfile:
             path: /etc/modprobe.d/blacklist.conf
             regexp: "^(#)?blacklist hfs(\\s|$)"
             line: "blacklist hfs"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.6 | PATCH | Ensure mounting of hfs filesystems is disable | Disable hfs"
         community.general.modprobe:
@@ -200,15 +200,15 @@
             regexp: "^(#)?install hfsplus(\\s|$)"
             line: "install hfsplus /bin/true"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.7 | PATCH | Ensure mounting of hfsplus filesystems is disabled | blacklist"
         ansible.builtin.lineinfile:
             path: /etc/modprobe.d/blacklist.conf
             regexp: "^(#)?blacklist hfsplus(\\s|$)"
             line: "blacklist hfsplus"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.1.7 | PATCH | Ensure mounting of hfsplus filesystems is disable | Disable hfsplus"
         community.general.modprobe:

tasks/section_1/cis_1.1.2.x.yml

@@ -62,7 +62,7 @@
       dest: /etc/systemd/system/tmp.mount
       owner: root
       group: root
-      mode: '0644'
+      mode: 'u-x,go-wx'
   notify: Systemd restart tmp.mount
   when:
       - amzn2023cis_tmp_svc

tasks/section_1/cis_1.1.9.yml

@@ -10,7 +10,7 @@
             create: true
             owner: root
             group: root
-            mode: '0600'
+            mode: 'u-x,go-rwx'
 
       - name: "1.1.9 | PATCH | Disable USB Storage | Edit modprobe config"
         community.general.modprobe:
@@ -24,7 +24,7 @@
             regexp: "^(#)?blacklist usb-storage(\\s|$)"
             line: "blacklist usb-storage"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
   when:
       - amzn2023cis_rule_1_1_9
   tags:

tasks/section_1/cis_1.7.x.yml

@@ -6,7 +6,7 @@
       dest: /etc/motd
       owner: root
       group: root
-      mode: '0644'
+      mode: 'u-x,go-wx'
   when:
       - amzn2023cis_rule_1_7_1
   tags:
@@ -22,7 +22,7 @@
       dest: /etc/issue
       owner: root
       group: root
-      mode: '0644'
+      mode: 'u-x,go-wx'
   when:
       - amzn2023cis_rule_1_7_2
   tags:
@@ -39,7 +39,7 @@
       dest: /etc/issue.net
       owner: root
       group: root
-      mode: '0644'
+      mode: 'u-x,go-wx'
   when:
       - amzn2023cis_rule_1_7_3
   tags:
@@ -56,7 +56,7 @@
       path: /etc/motd
       owner: root
       group: root
-      mode: '0644'
+      mode: 'u-x,go-wx'
   when:
       - amzn2023cis_rule_1_7_4
   tags:
@@ -72,7 +72,7 @@
       path: /etc/issue
       owner: root
       group: root
-      mode: '0644'
+      mode: 'u-x,go-wx'
   when:
       - amzn2023cis_rule_1_7_5
   tags:
@@ -88,7 +88,7 @@
       path: /etc/issue.net
       owner: root
       group: root
-      mode: '0644'
+      mode: 'u-x,go-wx'
   when:
       - amzn2023cis_rule_1_7_6
   tags:

tasks/section_2/cis_2.1.x.yml

@@ -22,15 +22,15 @@
             dest: /etc/chrony.d/chrony.conf
             owner: root
             group: root
-            mode: '0644'
+            mode: 'u-x,go-wx'
 
       - name: "2.1.2 | PATCH | Ensure chrony is configured | modify /etc/sysconfig/chronyd | 1"
         ansible.builtin.lineinfile:
             path: /etc/sysconfig/chronyd
             regexp: "^(#)?OPTIONS"
             line: "OPTIONS=\"-u chrony\""
             create: true
-            mode: '0644'
+            mode: 'u-x,go-wx'
   when:
       - amzn2023cis_rule_2_1_2
       - not system_is_container

tasks/section_3/cis_3.1.x.yml

@@ -30,7 +30,7 @@
         ansible.builtin.template:
             src: "etc/modprobe.d/modprobe.conf.j2"
             dest: "/etc/modprobe.d/{{ item }}.conf"
-            mode: '0600'
+            mode: 'u-x,go-rwx'
             owner: root
             group: root
         loop:
@@ -42,7 +42,7 @@
             regexp: "^(#)?blacklist {{ protocol }}(\\s|$)"
             line: "blacklist {{ protocol }}"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
   vars:
       protocol: dccp
   when:
@@ -60,7 +60,7 @@
         ansible.builtin.template:
             src: "etc/modprobe.d/modprobe.conf.j2"
             dest: "/etc/modprobe.d/{{ item }}.conf"
-            mode: '0600'
+            mode: 'u-x,go-rwx'
             owner: root
             group: root
         loop:
@@ -72,7 +72,7 @@
             regexp: "^(#)?blacklist {{ protocol }}(\\s|$)"
             line: "blacklist {{ protocol }}"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
   vars:
       protocol: sctp
   when:
@@ -91,7 +91,7 @@
         ansible.builtin.template:
             src: "etc/modprobe.d/modprobe.conf.j2"
             dest: "/etc/modprobe.d/{{ item }}.conf"
-            mode: '0600'
+            mode: 'u-x,go-rwx'
             owner: root
             group: root
         loop:
@@ -103,7 +103,7 @@
             regexp: "^(#)?blacklist {{ protocol }}(\\s|$)"
             line: "blacklist {{ protocol }}"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
   vars:
       protocol: rds
   when:
@@ -121,7 +121,7 @@
         ansible.builtin.template:
             src: "etc/modprobe.d/modprobe.conf.j2"
             dest: "/etc/modprobe.d/{{ item }}.conf"
-            mode: '0600'
+            mode: 'u-x,go-rwx'
             owner: root
             group: root
         loop:
@@ -133,7 +133,7 @@
             regexp: "^(#)?blacklist {{ protocol }}(\\s|$)"
             line: "blacklist {{ protocol }}"
             create: true
-            mode: '0600'
+            mode: 'u-x,go-rwx'
   vars:
       protocol: tipc
   when:

tasks/section_4/cis_4.1.x.yml

@@ -22,7 +22,7 @@
       path: /etc/crontab
       owner: root
       group: root
-      mode: '0600'
+      mode: 'u-x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_2
   tags:
@@ -39,7 +39,7 @@
       state: directory
       owner: root
       group: root
-      mode: '0700'
+      mode: 'u+x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_3
   tags:
@@ -56,7 +56,7 @@
       state: directory
       owner: root
       group: root
-      mode: '0700'
+      mode: 'u+x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_4
   tags:
@@ -73,7 +73,7 @@
       state: directory
       owner: root
       group: root
-      mode: '0700'
+      mode: 'u+x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_5
   tags:
@@ -89,7 +89,7 @@
       state: directory
       owner: root
       group: root
-      mode: '0700'
+      mode: 'u+x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_6
   tags:
@@ -105,7 +105,7 @@
       state: directory
       owner: root
       group: root
-      mode: '0700'
+      mode: 'u+x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_7
   tags:
@@ -134,7 +134,7 @@
             state: '{{ "file" if  amzn2023cis_5_1_8_cron_allow_state.stat.exists else "touch" }}'
             owner: root
             group: root
-            mode: '0600'
+            mode: 'u-x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_8
   tags:
@@ -163,7 +163,7 @@
             state: '{{ "file" if  amzn2023cis_5_1_9_at_allow_state.stat.exists else "touch" }}'
             owner: root
             group: root
-            mode: '0600'
+            mode: 'u-x,go-rwx'
   when:
       - amzn2023cis_rule_4_1_9
   tags: