Install and configure Audita

tests/verify.yml

@@ -0,0 +1,85 @@
+---
+- name: Verify Audita installation
+  hosts: localhost
+  gather_facts: false
+  tasks:
+    - name: Confirm selected source commit
+      become: true
+      ansible.builtin.command:
+        argv:
+          - git
+          - -C
+          - /usr/local/src/audita
+          - rev-parse
+          - HEAD
+      register: audita_commit
+      changed_when: false
+
+    - name: Check selected source commit
+      ansible.builtin.assert:
+        that:
+          - audita_commit.stdout == audita_expected_commit
+
+    - name: Inspect source ownership
+      become: true
+      ansible.builtin.command:
+        argv:
+          - find
+          - /usr/local/src/audita
+          - -not
+          - -user
+          - root
+          - -o
+          - -not
+          - -group
+          - root
+      register: audita_source_ownership
+      changed_when: false
+
+    - name: Check source ownership
+      ansible.builtin.assert:
+        that:
+          - audita_source_ownership.stdout == ""
+
+    - name: Inspect binary metadata
+      become: true
+      ansible.builtin.stat:
+        path: /usr/local/bin/audita
+      register: audita_binary_metadata
+
+    - name: Check binary metadata
+      ansible.builtin.assert:
+        that:
+          - audita_binary_metadata.stat.pw_name == "root"
+          - audita_binary_metadata.stat.gr_name == "root"
+          - audita_binary_metadata.stat.mode == "0755"
+          - audita_binary_metadata.stat.executable
+
+    - name: Inspect configuration metadata
+      become: true
+      ansible.builtin.stat:
+        path: /usr/local/etc/audita/config.yml
+      register: audita_config_metadata
+
+    - name: Check configuration metadata
+      ansible.builtin.assert:
+        that:
+          - audita_config_metadata.stat.pw_name == "root"
+          - audita_config_metadata.stat.gr_name == "root"
+          - audita_config_metadata.stat.mode == "0644"
+
+    - name: Validate Audita configuration
+      ansible.builtin.command:
+        argv:
+          - /usr/local/bin/audita
+          - config
+          - validate
+          - --config
+          - /usr/local/etc/audita/config.yml
+      register: audita_config_validation
+      changed_when: false
+
+    - name: Check configuration validation output
+      ansible.builtin.assert:
+        that:
+          - audita_config_validation.stdout == "config is valid"