Configure Additional Process Handling

handlers/main.yml

@@ -49,3 +49,7 @@
   ansible.builtin.systemd:
     name: systemd-journald
     state: restarted
+
+- name: reload systemd reexec
+  ansible.builtin.command: systemctl daemon-reexec
+  become: true

tasks/amazon_linux.yaml

@@ -0,0 +1,3 @@
+---
+- name: Amazon Linux 2 | Configure Additional Process handling
+  include_tasks: configure_additional_process_handling_al2.yaml

tasks/configure_additional_process_handling_al2.yaml

@@ -0,0 +1,29 @@
+---
+# Kernel hardening parameters
+- name: "Configure kernel hardening parameters"
+  ansible.builtin.sysctl:
+    name: "{{ item.name }}"
+    value: "{{ item.value }}"
+    state: present
+    sysctl_set: true
+    reload: yes
+    sysctl_file: /etc/sysctl.d/60-kernel_sysctl.conf
+  loop:
+    - { name: "kernel.randomize_va_space", value: "2", desc: "Ensure ASLR is enabled" }
+    - { name: "kernel.yama.ptrace_scope", value: "1", desc: "Restrict ptrace_scope" }
+  loop_control:
+    label: "{{ item.desc }}"
+
+# Core dump restrictions
+- name: "Configure core dump restrictions"
+  ansible.builtin.blockinfile:
+    path: /etc/systemd/coredump.conf
+    create: yes
+    block: "{{ item.block }}"
+  loop:
+    - { block: "[Coredump]\nProcessSizeMax=0", desc: "Disable core dump backtraces" }
+    - { block: "[Coredump]\nStorage=none", desc: "Disable core dump storage" }
+  loop_control:
+    label: "{{ item.desc }}"
+  notify:
+    - reload systemd reexec

tasks/main.yaml

@@ -1,16 +1,18 @@
 ---
-- name: Include CIS Stage Specific vars
-  include_vars: cis-{{ cis_Stage }}.yaml
-
-- name: Debian realted Specification
-  include_tasks: configure_Debian.yaml
+- name: Ubuntu related Specification
+  include_tasks: ubuntu.yaml
   when:
     ansible_os_family == 'Debian'
 
-- name: Centos realted Specification
-  include_tasks: configure_RedHat.yaml
+- name: CentOS related Specification
+  include_tasks: centos.yaml
+  when:
+    ansible_os_family == 'RedHat' and ansible_distribution != 'Amazon'
+
+- name: Amazon Linux 2 related Specification
+  include_tasks: amazon_linux.yaml
   when:
-    ansible_os_family == 'RedHat'
+    ansible_distribution == 'Amazon'
 
 # - name: Special purpose services
 #   include_tasks: services.yaml