Do not make bootloader config less secure

Signed-off-by: Karl DeBisschop <[email protected]>
ansible-lockdown · Mar 24, 2024 · a18fc7d · a18fc7d
1 parent 38b4140
commit a18fc7d
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/tasks/section_1/cis_1.4.x.yml b/tasks/section_1/cis_1.4.x.yml
@@ -50,6 +50,7 @@
             mode: 0600
         when:
             - ubtu20cis_1_4_2_grub_cfg_status.stat.exists
+            - ubtu20cis_1_4_2_grub_cfg_status.stat.mode != "0400"
   when:
       - ubtu20cis_rule_1_4_2
   tags: