86 lines
2.3 KiB
YAML
86 lines
2.3 KiB
YAML
---
|
|
- name: Verify Audita installation
|
|
hosts: localhost
|
|
gather_facts: false
|
|
tasks:
|
|
- name: Confirm selected source commit
|
|
become: true
|
|
ansible.builtin.command:
|
|
argv:
|
|
- git
|
|
- -C
|
|
- /usr/local/src/audita
|
|
- rev-parse
|
|
- HEAD
|
|
register: audita_commit
|
|
changed_when: false
|
|
|
|
- name: Check selected source commit
|
|
ansible.builtin.assert:
|
|
that:
|
|
- audita_commit.stdout == audita_expected_commit
|
|
|
|
- name: Inspect source ownership
|
|
become: true
|
|
ansible.builtin.command:
|
|
argv:
|
|
- find
|
|
- /usr/local/src/audita
|
|
- -not
|
|
- -user
|
|
- root
|
|
- -o
|
|
- -not
|
|
- -group
|
|
- root
|
|
register: audita_source_ownership
|
|
changed_when: false
|
|
|
|
- name: Check source ownership
|
|
ansible.builtin.assert:
|
|
that:
|
|
- audita_source_ownership.stdout == ""
|
|
|
|
- name: Inspect binary metadata
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: /usr/local/bin/audita
|
|
register: audita_binary_metadata
|
|
|
|
- name: Check binary metadata
|
|
ansible.builtin.assert:
|
|
that:
|
|
- audita_binary_metadata.stat.pw_name == "root"
|
|
- audita_binary_metadata.stat.gr_name == "root"
|
|
- audita_binary_metadata.stat.mode == "0755"
|
|
- audita_binary_metadata.stat.executable
|
|
|
|
- name: Inspect configuration metadata
|
|
become: true
|
|
ansible.builtin.stat:
|
|
path: /usr/local/etc/audita/config.yml
|
|
register: audita_config_metadata
|
|
|
|
- name: Check configuration metadata
|
|
ansible.builtin.assert:
|
|
that:
|
|
- audita_config_metadata.stat.pw_name == "root"
|
|
- audita_config_metadata.stat.gr_name == "root"
|
|
- audita_config_metadata.stat.mode == "0644"
|
|
|
|
- name: Validate Audita configuration
|
|
ansible.builtin.command:
|
|
argv:
|
|
- /usr/local/bin/audita
|
|
- config
|
|
- validate
|
|
- --config
|
|
- /usr/local/etc/audita/config.yml
|
|
register: audita_config_validation
|
|
changed_when: false
|
|
|
|
- name: Check configuration validation output
|
|
ansible.builtin.assert:
|
|
that:
|
|
- audita_config_validation.stdout == "config is valid"
|