[os_hardening] Task for setting initramfs modules does not match its condition

[BVollmerhaus]

Describe the bug

The os_hardening role's sysctl task file contains a task called "Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled". Whether module loading is enabled is controlled by the os_security_kernel_enable_module_loading variable, which is true by default.

As far as I can see, the task checks for the variable to be true in order to execute:

name: Rebuild initramfs with starting pack of modules, if module loading at runtime is disabled
[...]
when:
    - ansible_facts.os_family == 'Debian'
    - os_security_kernel_enable_module_loading

If I'm not mistaken, this is either a case of the task name being incorrect or the condition not being negated, whichever is the intended behavior. But it's late, so I hope I'm not confusing things here. 🙂

Role Version

8.2.0

[schurzi]

very nice catch!
The basic intention here is to preload all modules, when we have disabled kernel module loading via sysctl.
We have not set this specific sysctl for a very long time:

ansible-collection-hardening/roles/os_hardening/defaults/main.yml

Lines 116 to 119 in 53be805

	# This setting controls how the kernel behaves towards module changes at
	# runtime. Setting to 1 will disable module loading at runtime.
	# Setting it to 0 is actually never supported. | sysctl-29
	# kernel.modules_disabled: 1

[rndmh3ro]

Feature is deprecated. See #618