From 6521784917b4a455072ae236641d4128ccda4861 Mon Sep 17 00:00:00 2001 From: Mark Bolwell Date: Tue, 17 Sep 2024 08:48:40 +0100 Subject: [PATCH] Improved mode logic for audit log Signed-off-by: Mark Bolwell --- tasks/section_4/cis_4.1.4.x.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tasks/section_4/cis_4.1.4.x.yml b/tasks/section_4/cis_4.1.4.x.yml index b97e9b71..98c9e192 100644 --- a/tasks/section_4/cis_4.1.4.x.yml +++ b/tasks/section_4/cis_4.1.4.x.yml @@ -23,7 +23,7 @@ "4.1.4.3 | PATCH | Ensure only authorized groups are assigned ownership of audit log files" ansible.builtin.file: path: "{{ audit_discovered_logfile.stdout }}" - mode: "{% if auditd_logfile.stat.mode > '0640' %}0640{% endif %}" + mode: 'u-x,g-wx,o-rwx' owner: root group: root when: