search

ansible-lockdown / UBUNTU22-CIS

Ansible role for Ubuntu22 CIS Baseline
https://ansible-lockdown.readthedocs.io/en/latest/
MIT License
160 stars 70 forks source link

🐛 Correct default value for `ubtu22cis_grub_file: /boot/grub/grub.cfg` #117

Closed raabf closed 9 months ago

raabf commented 10 months ago

Overall Review of Changes:

CIS's assessment for rule 1.4.2 Ensure permissions on bootloader config are configured uses wrong /boot/grub/grub.cfg.

Issue Fixes: N/A

Enhancements: I think the current value defined within the variable ubtu22cis_grub_file(respectively /etc/default/grub.cfg) is wrong, as it is a mix between:

DEFAULT FILE: /etc/default/grub THE AUTO-GENERATED GRUB FILE: /boot/grub/grub.cfg

So the current value /boot/grub/grub.cfg is a non-existant file, but CIS rule means /boot/grub/grub.cfg.

Thanks to @ipruteanu-sie for finding the issue ;-)

How has this been tested?:

Executing the task, look at the result, and CIS-CAT Scanner succeeds.

uk-bolly commented 9 months ago

hi @raabf

Thank you for this PR, I believe this has already been addressed by #116.

many thanks

uk-bolly

raabf commented 9 months ago

Ah, you are correct! Then I have overseen!