Update audit_rules_suid_privilege_function to use ExecStart instead o…

…f ExecStartPost. RHEL10 does not use the old ExecStartPost directive anymore.
ComplianceAsCode · Oct 28, 2024 · d13c361 · d13c361
1 parent cf53352
commit d13c361
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/...diting/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml b/...diting/auditd_configure_rules/audit_rules_suid_auid_privilege_function/ansible/shared.yml
@@ -12,12 +12,20 @@
 
 {{% set rx_end = "(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$" %}}
 
+{{% if product == 'rhel10' %}}
+{{% set audit_loading_systemd_directive="ExecStart" %}}
+{{% set audit_loading_service_file="audit-rules.service" %}}
+{{% else %}}
+{{% set audit_loading_systemd_directive="ExecStartPost" %}}
+{{% set audit_loading_service_file="auditd.service" %}}
+{{% endif %}}
+
 - name: Service facts
   ansible.builtin.service_facts:
 
 - name: Check the rules script being used
   ansible.builtin.command:
-    grep '^ExecStartPost' /usr/lib/systemd/system/auditd.service
+    grep '^{{{ audit_loading_systemd_directive }}}' /usr/lib/systemd/system/{{{ audit_loading_service_file }}}
   register: check_rules_scripts_result
   changed_when: false
   failed_when: false