Fix for Control 7.2.10

defaults/main.yml

@@ -1326,3 +1326,9 @@ deb12cis_suid_sgid_adjust: false
 ## Control 7.1.11 - Ensure no world writable files exist
 # Allow ansible to adjust world-writable files. False will just display world-writable files, True will remove world-writable.
 deb12cis_no_world_write_adjust: true
+
+## Control 7.2.10 - Ensure local interactive user dot files access is configured
+# This variable is a toggle foe enabling/disabling the automated modification of
+# permissions on dot files.
+# Possible values are `true` and `false`.
+deb12cis_dotperm_ansiblemanaged: true

tasks/section_7/cis_7.2.x.yml

@@ -310,33 +310,53 @@
   vars:
     warn_control_id: '7.2.10'
   block:
+
+    - name: "7.2.10 | AUDIT | Ensure local interactive user dot files access is configured | Get the users' home dirs"
+      ansible.builtin.shell: "getent passwd | awk -F: '$7 !~ \"/usr/bin/false|/bin/false|/sbin/nologin|/usr/sbin/nologin\" {print $6}'"
+      changed_when: false
+      failed_when: discovered_users_homedirs.rc not in [ 0, 1 ]
+      check_mode: false
+      register: discovered_users_homedirs
+
     - name: "7.2.10 | AUDIT | Ensure local interactive user dot files access is configured | Check for files"
-      ansible.builtin.shell: find /home/ -name "\.*" -perm /g+w,o+w
+      ansible.builtin.shell: find {{ item }}/ -type f -name "\.*" ! -perm -0644
       changed_when: false
       failed_when: discovered_homedir_dot_files.rc not in [ 0, 1 ]
       check_mode: false
       register: discovered_homedir_dot_files
+      loop: "{{ discovered_users_homedirs.stdout_lines }}"
 
     - name: "7.2.10 | AUDIT | Ensure local interactive user dot files access is configured | Warning on files found"
       when:
-        - discovered_homedir_dot_files.stdout | length > 0
+        - discovered_homedir_dot_files.results | length > 0
         - deb12cis_dotperm_ansiblemanaged
       ansible.builtin.debug:
         msg:
           - "Warning!! We have discovered group or world-writable dot files on your system and this host is configured for manual intervention. Please investigate these files further."
 
     - name: "7.2.10 | PATCH | Ensure local interactive user dot files access is configured | Set warning count"
       when:
-        - discovered_homedir_dot_files.stdout | length > 0
+        - discovered_homedir_dot_files.results | length > 0
         - deb12cis_dotperm_ansiblemanaged
       ansible.builtin.import_tasks:
         file: warning_facts.yml
 
-    - name: "7.2.10 | PATCH | Ensure local interactive user dot files access is configured | Changes files if configured"
+    - name: "7.2.10 | PATCH | Ensure local interactive user dot files access is configured | Add right permissions for general files"
+      when:
+        - discovered_homedir_dot_files.results | length > 0
+        - deb12cis_dotperm_ansiblemanaged
+        - item | basename not in ['.ansible','.bash_profile','.bash_history','.netrc']
+      ansible.builtin.file:
+        path: '{{ item }}'
+        mode: 'go-wx,u-x'
+      loop: "{{ discovered_homedir_dot_files.results | map(attribute='stdout_lines') | list | flatten }}"
+
+    - name: "7.2.10 | PATCH | Ensure local interactive user dot files access is configured | Add right permissions for .bash_profile, .bash_history or .netrc files"
       when:
-        - discovered_homedir_dot_files.stdout | length > 0
+        - discovered_homedir_dot_files.results | length > 0
         - deb12cis_dotperm_ansiblemanaged
+        - item | basename == '.bash_profile' or item | basename == '.netrc' or item | basename == '.bash_history'
       ansible.builtin.file:
         path: '{{ item }}'
-        mode: 'go-w'
-      loop: "{{ discovered_homedir_dot_files.stdout_lines }}"
+        mode: 'go-rwx,u-x'
+      loop: "{{ discovered_homedir_dot_files.results | map(attribute='stdout_lines') | list | flatten }}"