From 35b36c780f774c0e34c234bdb754fc9d5d6887ab Mon Sep 17 00:00:00 2001 From: Gabriel Becker Date: Mon, 28 Oct 2024 14:51:23 +0100 Subject: [PATCH] Update audit_rules_suid_privilege_function to use ExecStart instead of ExecStartPost. RHEL10 does not use the old ExecStartPost directive anymore. --- .../ansible/shared.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml index 64e8dde853e..2d3d2aa44df 100644 --- a/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml +++ b/linux_os/guide/auditing/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml @@ -12,12 +12,17 @@ {{% set rx_end = "(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$" %}} +{{%- set exec_start_directive = 'ExecStartStop' %}} +{{%- if product in ["rhel10"] %}} +{{%- set exec_start_directive = 'ExecStart' %}} +{{%- endif %}} + - name: Service facts ansible.builtin.service_facts: - name: Check the rules script being used ansible.builtin.command: - grep '^ExecStartPost' /usr/lib/systemd/system/auditd.service + grep '^{{{ exec_start_directive }}}' /usr/lib/systemd/system/auditd.service register: check_rules_scripts_result changed_when: false failed_when: false