5cccad8ed4
* added win_audit_rule with integration test * Updated integration testing to target files as well as directories and registry keys. Split testing files apart to be more organized. Updated powershell for better handling when targetting file objects and optimized a bit. Removed duplicated sections that got there from a previous merge I think. * Decided to make all the fact names the same in integration testing. Seemed like there would be less change of accidentally using the wrong variable when copy/pasting that way, and not much upside to having unique names. Did final cleanup and fixed a few errors in the integration testing. * Fixed a bug where results was displaying a wrong value Fixed a bug where removal was failing if multiple rules existed due to inheritance from higher level objects. * Resolved issue with unhandled error when used didn't have permissions for get-acl. Changed from setauditrule to addauditrule, see comment in script for reasoning. Fixed state absent to be able to remove multiple entries if they exist. * fixed docs issue * updated to fail if invalid inheritance_rule when defining a file rather than warn
172 lines
5.5 KiB
YAML
172 lines
5.5 KiB
YAML
######################
|
|
### check mode add ###
|
|
######################
|
|
- name: check mode ADD audit policy directory
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_folder }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: directory
|
|
check_mode: yes
|
|
|
|
- name: check mode ADD audit policy file
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_file }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
inheritance_flags: none
|
|
register: file
|
|
check_mode: yes
|
|
|
|
- name: check mode ADD audit policy registry
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_registry }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: registry
|
|
check_mode: yes
|
|
|
|
- name: check mode ADD get directory results
|
|
test_get_audit_rule:
|
|
path: "{{ test_audit_rule_folder }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: directory_results
|
|
|
|
- name: check mode ADD get file results
|
|
test_get_audit_rule:
|
|
path: "{{ test_audit_rule_file }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
inheritance_flags: none
|
|
register: file_results
|
|
|
|
- name: check mode ADD get REGISTRY results
|
|
test_get_audit_rule:
|
|
path: "{{ test_audit_rule_registry }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: registry_results
|
|
|
|
- name: check mode ADD assert that a change is needed, but no change occurred to the audit rules
|
|
assert:
|
|
that:
|
|
- directory | changed
|
|
- file | changed
|
|
- registry | changed
|
|
- not directory_results.matching_rule_found and directory_results.path_type == 'directory'
|
|
- not file_results.matching_rule_found and file_results.path_type == 'file'
|
|
- not registry_results.matching_rule_found and registry_results.path_type == 'registry'
|
|
|
|
##################
|
|
### add a rule ###
|
|
##################
|
|
- name: ADD audit policy directory
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_folder }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: directory
|
|
|
|
- name: ADD audit policy file
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_file }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
inheritance_flags: none
|
|
register: file
|
|
|
|
- name: ADD audit policy registry
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_registry }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: registry
|
|
|
|
- name: ADD get directory results
|
|
test_get_audit_rule:
|
|
path: "{{ test_audit_rule_folder }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: directory_results
|
|
|
|
- name: ADD get file results
|
|
test_get_audit_rule:
|
|
path: "{{ test_audit_rule_file }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
inheritance_flags: none
|
|
register: file_results
|
|
|
|
- name: ADD get REGISTRY results
|
|
test_get_audit_rule:
|
|
path: "{{ test_audit_rule_registry }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: registry_results
|
|
|
|
- name: ADD assert that the rules were added and a change is detected
|
|
assert:
|
|
that:
|
|
- directory | changed
|
|
- file | changed
|
|
- registry | changed
|
|
- directory_results.matching_rule_found and directory_results.path_type == 'directory'
|
|
- file_results.matching_rule_found and file_results.path_type == 'file'
|
|
- registry_results.matching_rule_found and registry_results.path_type == 'registry'
|
|
|
|
#############################
|
|
### idempotent add a rule ###
|
|
#############################
|
|
- name: idempotent ADD audit policy directory
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_folder }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: directory
|
|
|
|
- name: idempotent ADD audit policy file
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_file }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
inheritance_flags: none
|
|
register: file
|
|
|
|
- name: idempotent ADD audit policy registry idempotent
|
|
win_audit_rule:
|
|
path: "{{ test_audit_rule_registry }}"
|
|
user: "{{ test_audit_rule_user }}"
|
|
rights: "{{ test_audit_rule_rights }}"
|
|
state: present
|
|
audit_flags: "{{ test_audit_rule_audit_flags }}"
|
|
register: registry
|
|
|
|
- name: idempotent ADD assert that a change did not occur
|
|
assert:
|
|
that:
|
|
- not directory | changed and directory.path_type == 'directory'
|
|
- not file | changed and file.path_type == 'file'
|
|
- not registry | changed and registry.path_type == 'registry'
|