new files from source

Infrastrucutre as Code/Ansible/roles/cis_hardening/filesystem_hardening/tasks/main.yml

@@ -0,0 +1,34 @@
+---
+# Remount and persist secure options using defaults variables
+
+- name: Gather mount facts
+  ansible.builtin.setup:
+    filter: ansible_mounts
+
+- name: Ensure /tmp has secure mount options
+  ansible.builtin.mount:
+    path: /tmp
+    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/tmp') | map(attribute='fstype') | first }}"
+    opts: "{{ tmp_mount_options }}"
+    state: mounted
+
+- name: Ensure /var/tmp has secure mount options
+  ansible.builtin.mount:
+    path: /var/tmp
+    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/var/tmp') | map(attribute='fstype') | first }}"
+    opts: "{{ var_tmp_mount_options }}"
+    state: mounted
+
+- name: Ensure /home has secure mount options
+  ansible.builtin.mount:
+    path: /home
+    fstype: "{{ ansible_mounts | selectattr('mount','equalto','/home') | map(attribute='fstype') | first }}"
+    opts: "{{ home_mount_options }}"
+    state: mounted
+
+- name: Ensure /dev/shm has secure mount options
+  ansible.builtin.mount:
+    path: /dev/shm
+    fstype: tmpfs
+    opts: "{{ dev_shm_mount_options }}"
+    state: mounted