Added test for mac_frameworks

pyllyukko · Dec 17, 2024 · d65114a · d65114a
1 parent d0e6027
commit d65114a
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 3 deletions.
diff --git a/.github/workflows/ansible-playbook.yml b/.github/workflows/ansible-playbook.yml
@@ -123,3 +123,23 @@ jobs:
         with:
           name: lynis-malware.log
           path: /var/log/lynis.log
+  mac_frameworks:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Install Lynis
+        run: ansible-playbook -v harden.yml --tags lynis --skip-tags slackware,centos
+      - name: Run Lynis (pre-harden)
+        run: sudo lynis audit system --skip-plugins --tests-from-group mac_frameworks
+      - name: Run Ansible playbook for apparmor
+        run: ansible-playbook harden.yml --tags apparmor
+      - name: Run Lynis
+        run: sudo lynis audit system --skip-plugins --tests-from-group mac_frameworks
+      - name: chmod Lynis log
+        run: sudo chmod -c 644 /var/log/lynis.log
+      - name: Archive Lynis log
+        uses: actions/upload-artifact@v4
+        with:
+          name: lynis-mac_frameworks.log
+          path: /var/log/lynis.log
diff --git a/tasks/apparmor.yml b/tasks/apparmor.yml
@@ -1,6 +1,6 @@
 ---
 - name: Install AppArmor
-  when: ansible_distribution == "Debian" or ansible_distribution == "Kali"
+  when: ansible_distribution == "Debian" or ansible_distribution == "Kali" or ansible_distribution == "Ubuntu"
   become: true
   ansible.builtin.apt:
     name: ['apparmor', 'apparmor-profiles', 'apparmor-utils']
@@ -31,7 +31,7 @@
   with_items:
     - apparmor=1
     - security=apparmor
-  when: ansible_distribution == "Debian" or ansible_distribution == "Kali"
+  when: ansible_distribution == "Debian" or ansible_distribution == "Kali" or ansible_distribution == "Ubuntu"
   tags:
     - configuration
     - apparmor
@@ -94,7 +94,7 @@
       - usr.sbin.postqueue
       - usr.lib.dovecot.dovecot-lda
   become: true
-  when: ansible_distribution == "Debian" or ansible_distribution == "Kali"
+  when: ansible_distribution == "Debian" or ansible_distribution == "Kali" or ansible_distribution == "Ubuntu"
   block:
     - name: Copy extra profiles
       ansible.builtin.copy: