tech:ansible_add_mount_option_for_hardening_-_loop_on_ansible_mounts

Ansible add mount option for hardening - loop on ansible mounts

- name: add nodev mount option for all LVM mounts exept root part
  mount:
    name: '{{ item.mount }}'
    src: '{{ item.device }}' # UUID not needed when LVM
    state: mounted
    fstype: '{{ item.fstype }}'
    opts: "{{ item.options |regex_replace(',nodev','') }},nodev" # Fix duplicate
  when: item.options.find("nodev") != -1 and item.device.find("mapper") != -1 and not item.mount in [ "/" ]
  with_items: '{{ ansible_mounts }}'

- name: add nodev mount option for all non-LVM mounts exept root part
  mount:
    name: '{{ item.mount }}'
    src: 'UUID={{ item.uuid }}'
    state: mounted
    fstype: '{{ item.fstype }}'
    opts: "{{ item.options |regex_replace(',nodev','') }},nodev" # Fix duplicate
  when: item.options.find("nodev") != -1 and item.device.find("mapper") == -1 and not item.mount in [ "/" ]
  with_items: '{{ ansible_mounts }}'

ou encore mieux

- name: add nodev mount option for all except root part
  mount:
    name: '{{ item.mount }}'
    # Pour les partitions non LVM, on utilise UUID, sinon on prend le device
    src: "{{ 'UUID=%s' % item.uuid if item.device.find('mapper') == -1 else item.device }}"
    state: present
    fstype: '{{ item.fstype }}'
    opts: "{{ item.options |regex_replace(',nodev','') }},nodev" # Fix duplicate
  when: item.options is not search("nodev") and not item.mount in [ "/", "/var/tmp" ]
  with_items: '{{ ansible_mounts }}'
  register: nodev_mounts
tech/ansible_add_mount_option_for_hardening_-_loop_on_ansible_mounts.txt · Dernière modification : de 127.0.0.1

Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki