From 4fff4793f64b66a76442c8024d3f673ca773912f Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 24 Aug 2023 11:29:19 -0500 Subject: [PATCH 1/2] Change enable_fips_mode to multi_platform_all --- .../software/integrity/fips/enable_fips_mode/ansible/shared.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml index 41d301caa49..d6dd56a1dc2 100644 --- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml @@ -1,4 +1,4 @@ -# platform = Red Hat Enterprise Linux 8,multi_platform_fedora,Oracle Linux 8 +# platform = multi_platform_all # reboot = true # strategy = restrict # complexity = medium From 44985697942a356a323ce2c7db8a177d3d817b73 Mon Sep 17 00:00:00 2001 From: Matthew Burket Date: Thu, 24 Aug 2023 11:32:54 -0500 Subject: [PATCH 2/2] Update enable_fips_mode to follow the style guide --- .../fips/enable_fips_mode/ansible/shared.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml index d6dd56a1dc2..bd7bd5174b9 100644 --- a/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml +++ b/linux_os/guide/system/software/integrity/fips/enable_fips_mode/ansible/shared.yml @@ -5,23 +5,23 @@ # disruption = medium {{{ ansible_instantiate_variables("var_system_crypto_policy") }}} -- name: Check to see the current status of FIPS mode - command: /usr/bin/fips-mode-setup --check +- name: "{{{ rule_title }}} - Check to See the Current Status of FIPS Mode" + ansible.builtin.command: /usr/bin/fips-mode-setup --check register: is_fips_enabled ignore_errors: yes changed_when: false -- name: Enable FIPS mode - command: /usr/bin/fips-mode-setup --enable +- name: "{{{ rule_title }}} - Enable FIPS Mode" + ansible.builtin.command: /usr/bin/fips-mode-setup --enable when: - is_fips_enabled.stdout.find('FIPS mode is enabled.') == -1 -- name: "{{{ rule_title }}}" - lineinfile: +- name: "{{{ rule_title }}} - Configure Crypto Policy" + ansible.builtin.lineinfile: path: /etc/crypto-policies/config regexp: '^(?!#)(\S+)$' line: "{{ var_system_crypto_policy }}" create: yes -- name: Verify that Crypto Policy is Set (runtime) - command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }} +- name: "{{{ rule_title }}} - Verify that Crypto Policy is Set (runtime)" + ansible.builtin.command: /usr/bin/update-crypto-policies --set {{ var_system_crypto_policy }}