Only run hardening if /var/log/audit exists (dev-sec#550)

* Only run harding if /var/log/audit exists

Signed-off-by: GitHub <noreply@github.com>

* Update roles/os_hardening/tasks/minimize_access.yml

* add more conditionals to when auditd show be hardened

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* add more tests to the os-hardening vm tests

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

* Revert "add more tests to the os-hardening vm tests"

This reverts commit c05fe8b.

Signed-off-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

Co-authored-by: Sebastian Gumprich <rndmh3ro@users.noreply.github.com>
Co-authored-by: Sebastian Gumprich <sebastian.gumprich@t-systems.com>

roles/os_hardening/tasks/minimize_access.yml

@@ -208,6 +208,11 @@
     group: 'root'
     mode: '{{ os_mnt_var_log_dir_mode }}'
 
+- name: Check if /var/log/audit exists
+  stat:
+    path: /var/log/audit
+  register: var_log_audit_exists
+
 - name: Mount /var/log/audit with hardened options
   mount:
     path: /var/log/audit
@@ -216,14 +221,21 @@
     opts: '{{ os_mnt_var_log_audit_options }}'
     state: present
   register: varlogauditmount
-  when: os_mnt_var_log_audit_enabled | bool
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
 
 - name: Harden permissions for /var/log/audit directory
   file:
     dest: /var/log/audit
     owner: 'root'
     group: 'root'
     mode: '{{ os_mnt_var_log_audit_dir_mode }}'
+  when:
+    - os_mnt_var_log_audit_enabled | bool
+    - var_log_audit_exists.stat.exists | bool
+    - os_auditd_enabled | bool
 
 - name: Mount /var/tmp with hardened options
   mount: