feat: Import code for role

Signed-off-by: Radovan Sroka <rsroka@redhat.com>

README.md

@@ -1,102 +1,93 @@
-# Role Name
+# AIDE
 
 [![ansible-lint.yml](https://github.com/linux-system-roles/aide/actions/workflows/ansible-lint.yml/badge.svg)](https://github.com/linux-system-roles/aide/actions/workflows/ansible-lint.yml) [![ansible-test.yml](https://github.com/linux-system-roles/aide/actions/workflows/ansible-test.yml/badge.svg)](https://github.com/linux-system-roles/aide/actions/workflows/ansible-test.yml) [![markdownlint.yml](https://github.com/linux-system-roles/aide/actions/workflows/markdownlint.yml/badge.svg)](https://github.com/linux-system-roles/aide/actions/workflows/markdownlint.yml) [![shellcheck.yml](https://github.com/linux-system-roles/aide/actions/workflows/shellcheck.yml/badge.svg)](https://github.com/linux-system-roles/aide/actions/workflows/shellcheck.yml) [![tft.yml](https://github.com/linux-system-roles/aide/actions/workflows/tft.yml/badge.svg)](https://github.com/linux-system-roles/aide/actions/workflows/tft.yml) [![tft_citest_bad.yml](https://github.com/linux-system-roles/aide/actions/workflows/tft_citest_bad.yml/badge.svg)](https://github.com/linux-system-roles/aide/actions/workflows/tft_citest_bad.yml) [![woke.yml](https://github.com/linux-system-roles/aide/actions/workflows/woke.yml/badge.svg)](https://github.com/linux-system-roles/aide/actions/workflows/woke.yml)
 
-Ansible role for managing Advanced Intrusion Detection Environment (AIDE).
+This is an ansible role that installs and configures the [Advanced Intrusion Detection Environment (AIDE)](https://aide.github.io). For Day 2 tasks it can run integrity checks and update the AIDE database.
+
+_Notice:_ This is a very early stage of a work in progress. Please use with
+extreme caution as it might break your system.
+
+## What does this role do for you?
+
+* It ensures that the `aide` package is installed on the remote nodes
+* As an optional task it can generate the `/etc/aide.conf` file and template it out to the remote nodes
+* It initializes the AIDE database
+* The AIDE databases from the remote nodes are stored in a central directory on the controller node
+* It runs AIDE integrity checks on the remote nodes
+* It updates the AIDE databases and stores them on the controller node
+
+## How does the role do that?
+
+* The role is controlled by using [Ansible Tags](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_tags.html)
+* If you run the playbook without specifying any tag the role will change nothing on your remote nodes
+* To execute some supported use cases you need to explicitly specify one or more of the following tags
+
+### Available tags to control and use the role
+
+* __install__ - With this tag the role ensures that the `aide` package is installed on the remote nodes
+* __generate_config__ - Generates the file `/etc/aide.conf` using `templates/aide.conf.j2`; the template needs to be adjusted to fit your requirements; if you do not use this tag the default configuration file shipped with the `aide` package will be used
+* __init__ - Initializes the AIDE database and fetches it from the remote nodes to store it on the controller node
+* __check__ - Runs an integrity check on the remote nodes
+* __update__ - Updates the AIDE database and stores it on the controller node
+
+## What does this role not do for you?
+
+* It does not explain how to create a good AIDE configuration that suits your requirements; that task remains for you to accomplish
 
 ## Requirements
 
-Any prerequisites that may not be covered by Ansible itself or the role should
+This role has no special requirements as it uses `ansible.builtin` modules
-be mentioned here.  This includes platform dependencies not managed by the
+only.
-role, hardware requirements, external collections, etc.  There should be a
-distinction between *control node* requirements (like collections) and
-*managed node* requirements (like special hardware, platform provisioning).
-
-### Collection requirements
-
-For instance, if the role depends on some collections and has a
-`meta/collection-requirements.yml` file for installing those dependencies, and
-in order to manage `rpm-ostree` systems, it should be mentioned here that the
- user should run
-
-```bash
-ansible-galaxy collection install -vv -r meta/collection-requirements.yml
-```
-
-on the *control node* before using the role.
 
 ## Role Variables
 
-A description of all input variables (i.e. variables that are defined in
+### aide_db_fetch_dir
-`defaults/main.yml`) for the role should go here as these form an API of the
-role.  Each variable should have its own section e.g.
 
-### aide_foo
+This variable takes a string to specify the directory on the Ansible Control
+Node (ACN) where the role will store the AIDE database fetched from the remote
+nodes. The default value is `files` which is expected to be a directory in the
+same directory as the playbook.
 
-This variable is required.  It is a string that lists the foo of the role.
+In case you like to store the fetched AIDE database files somewhere else you
-There is no default value.
+need to specify a different path here.
-
-### aide_bar
-
-This variable is optional.  It is a boolean that tells the role to disable bar.
-The default value is `true`.
-
-Variables that are not intended as input, like variables defined in
-`vars/main.yml`, variables that are read from other roles and/or the global
-scope (ie. hostvars, group vars, etc.) can be also mentioned here but keep in
-mind that as these are probably not part of the role API they may change during
-the lifetime.
 
 Example of setting the variables:
 
 ```yaml
-aide_foo: "oof"
+aide_db_fetch_dir: files
-aide_bar: false
 ```
 
-## Variables Exported by the Role
-
-This section is optional.  Some roles may export variables for playbooks to
-use later.  These are analogous to "return values" in Ansible modules.  For
-example, if a role performs some action that will require a system reboot, but
-the user wants to defer the reboot, the role might set a variable like
-`aide_reboot_needed: true` that the playbook can use to reboot at a more
-convenient time.
-
-Example:
-
-### aide_reboot_needed
-
-Default `false` - if `true`, this means a reboot is needed to apply the changes
-made by the role
-
 ## Example Playbook
 
 Including an example of how to use your role (for instance, with variables
 passed in as parameters) is always nice for users too:
 
 ```yaml
-- name: Manage the aide subsystem
+# SPDX-License-Identifier: MIT
-  hosts: all
+---
-  vars:
+- name: Example aide role invocation
-    aide_foo: "foo foo!"
+  hosts: targets
-    aide_bar: false
+  tasks:
-  roles:
+    - name: Include role aide
-    - linux-system-roles.aide
+      tags:
+        - install
+        - generate_config
+        - init
+        - check
+        - update
+      vars:
+        aide_db_fetch_dir: files
+      ansible.builtin.include_role:
+        name: aide
 ```
 
-More examples can be provided in the [`examples/`](examples) directory. These
+More examples can be found in the [`examples/`](examples) directory.
-can be useful, especially for documentation.
-
-## rpm-ostree
-
-See README-ostree.md
 
 ## License
 
-Whenever possible, please prefer MIT.
+MIT.
 
 ## Author Information
 
-An optional section for the role authors to include contact information, or a
+* Radovan Sroka
-website (HTML is not allowed).
+* Joerg Kastning

ansible_pytest_extra_requirements.txt

@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: MIT
+
+# ansible and dependencies for all supported platforms
+ansible ; python_version > "2.6"
+idna<2.8 ; python_version < "2.7"
+PyYAML<5.1 ; python_version < "2.7"

contributing.md

@@ -1,4 +1,4 @@
-# Contributing to the aide Linux System Role
+# Contributing to the Aide Linux System Role
 
 ## Where to start
 

defaults/main.yml

@@ -4,5 +4,4 @@
 # This file also serves as a documentation for such a variables.
 
 # Examples of role input variables:
-aide_foo: foo
+aide_db_fetch_dir: files
-aide_bar: true

examples/simple.yml

@@ -1,9 +1,16 @@
 # SPDX-License-Identifier: MIT
 ---
 - name: Example aide role invocation
-  hosts: all
+  hosts: targets
-  vars:
+  tasks:
-    aide_foo: example variable value
+    - name: Include role aide
-    aide_bar: false
+      tags:
-  roles:
+        - install
-    - linux-system-roles.aide
+        - generate_config
+        - init
+        - check
+        - update
+      vars:
+        aide_db_fetch_dir: files
+      ansible.builtin.include_role:
+        name: linux-system-roles.aide

meta/main.yml

@@ -1,20 +1,68 @@
 # SPDX-License-Identifier: MIT
 ---
 galaxy_info:
-  author: John Doe <jdoe@corp.com>
+  # Replace with role's author name:
-  description: Basic template for Linux system roles
+  author: Joerg Kastning <jkastning@my-it-brain.de>
-  company: John Doe, Inc.
+  # Replace with the real description of what is role's purpose:
+  description: Install, configure and operate AIDE
+  # Replace with the company the role's author is member of:
+  company: Red Hat
+
+  # If the issue tracker for your role is not on github, uncomment the next
+  # line and provide a value
+  # issue_tracker_url: http://example.com/issue/tracker
+
+  # Some suggested licenses:
+  # - BSD (default)
+  # - MIT
+  # - GPLv2
+  # - GPLv3
+  # - Apache
+  # - CC-BY
   license: MIT
+
   min_ansible_version: "2.9"
+
+  # Optionally specify the branch Galaxy will use when accessing the GitHub
+  # repo for this role. During role install, if no tags are available, Galaxy
+  # will use this branch. During import Galaxy will access files on this
+  # branch. If Travis integration is configured, only notifications for this
+  # branch will be accepted. Otherwise, in all cases, the repo's default branch
+  # (usually main) will be used.
+  # github_branch:
+
+  #
+  # platforms is a list of platforms, and each platform has a name and a list
+  # of versions.
+  #
+  # platforms:
+  # - name: Fedora
+  #   versions:
+  #   - all
+  #   - "25"
+  # - name: SomePlatform
+  #   versions:
+  #   - all
+  #   - "1.0"
+  #   - "7"
+  #   - "99.99"
   platforms:
+    # Replace the below with your platform list:
     - name: Fedora
       versions:
         - all
     - name: EL
       versions:
-        - "9"
+        - all
-  galaxy_tags:
+
-    - el9
+  galaxy_tags: []
-    - el10
+  # List tags for your role here, one per line. A tag is a keyword that
-    - fedora
+  # describes and categorizes the role. Users find roles by searching for tags.
+  # Be sure to remove the '[]' above, if you add tags to this list.
+  #
+  # NOTE: A tag is limited to a single word comprised of alphanumeric
+  #       characters. Maximum 20 tags per role.
+
 dependencies: []
+# List your role dependencies here, one per line. Be sure to remove the '[]'
+# above, if you add dependencies to this list.

pylint_extra_requirements.txt

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: MIT
+
+# Write extra requirements for running pylint here:

pytest_extra_requirements.txt

@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: MIT
+
+# Write extra requirements for running pytest here:
+# If you need ansible then uncomment the following line:
+-ransible_pytest_extra_requirements.txt
+# If you need mock then uncomment the following line:
+mock ; python_version < "3.0"

tasks/main.yml

@@ -5,23 +5,93 @@
 
 # Examples of some tasks:
 - name: Ensure required packages are installed
-  package:
+  ansible.builtin.package:
     name: "{{ __aide_packages }}"
     state: present
     use: "{{ (__aide_is_ostree | d(false)) |
              ternary('ansible.posix.rhel_rpm_ostree', omit) }}"
+  tags:
+    - never
+    - install
 
 - name: Ensure required services are enabled and started
-  service:
+  ansible.builtin.service:
     name: "{{ item }}"
     state: started
     enabled: true
   loop: "{{ __aide_services }}"
+  tags:
+    - never
 
-- name: Generate /etc/{{ __aide_foo_config }}
+- name: Generate "/etc/{{ __aide_config }}"
-  template:
+  ansible.builtin.template:
-    src: "{{ __aide_foo_config }}.j2"
+    src: "{{ __aide_config }}.j2"
-    dest: /etc/{{ __aide_foo_config }}
+    dest: "/etc/{{ __aide_config }}"
     backup: true
     mode: "0400"
-  notify: Handler for aide to restart services
+  tags:
+    - never
+    - generate_config
+
+- name: Initialize AIDE database and fetch it
+  become: true
+  tags:
+    - never
+    - init
+  block:
+    - name: Initialize AIDE database
+      ansible.builtin.command:
+        cmd: aide --init
+
+    - name: Fetch AIDE database
+      ansible.builtin.fetch:
+        src: "{{ __aide_db_new_name }}"
+        dest: "{{ aide_db_fetch_dir }}"
+
+    - name: Remove remote AIDE database file
+      ansible.builtin.file:
+        path: "{{ __aide_db_new_name }}"
+        state: absent
+
+- name: Check AIDE integrity
+  become: true
+  tags:
+    - never
+    - check
+  block:
+    - name: Copy AIDE reference database to remote
+      ansible.builtin.copy:
+        src:
+          "{{ aide_db_fetch_dir }}/{{ inventory_hostname }}/var/lib/aide/\
+          aide.db.new.gz"
+        dest: "{{ __aide_db_name }}"
+        owner: root
+        group: root
+        mode: "0440"
+
+    - name: Check against AIDE reference database
+      ansible.builtin.command:
+        cmd: aide --check
+      changed_when: false
+
+- name: Update AIDE database and fetch it
+  become: true
+  tags:
+    - never
+    - update
+  block:
+    - name: Update AIDE database
+      ansible.builtin.command:
+        cmd: aide --update
+      register: __aide_update_result
+      failed_when: __aide_update_result.rc > 7
+
+    - name: Fetch AIDE database
+      ansible.builtin.fetch:
+        src: "{{ __aide_db_new_name }}"
+        dest: "{{ aide_db_fetch_dir }}"
+
+    - name: Remove remote AIDE database file
+      ansible.builtin.file:
+        path: "{{ __aide_db_new_name }}"
+        state: absent

tasks/set_vars.yml

@@ -1,12 +1,12 @@
 ---
 - name: Ensure ansible_facts used by role
   setup:
-    gather_subset: "{{ __template_required_facts_subsets }}"
+    gather_subset: "{{ __aide_required_facts_subsets }}"
-  when: __template_required_facts |
+  when: __aide_required_facts |
     difference(ansible_facts.keys() | list) | length > 0
 
 - name: Determine if system is ostree and set flag
-  when: not __template_is_ostree is defined
+  when: not __aide_is_ostree is defined
   block:
     - name: Check if system is ostree
       stat:
@@ -15,7 +15,7 @@
 
     - name: Set flag to indicate system is ostree
       set_fact:
-        __template_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"
+        __aide_is_ostree: "{{ __ostree_booted_stat.stat.exists }}"
 
 - name: Set platform/version specific variables
   include_vars: "{{ __vars_file }}"

templates/aide.conf.j2

@@ -0,0 +1,304 @@
+# Example configuration file for AIDE.
+
+@@define DBDIR /var/lib/aide
+@@define LOGDIR /var/log/aide
+
+# The location of the database to be read.
+database=file:@@{DBDIR}/aide.db.gz
+
+# The location of the database to be written.
+#database_out=sql:host:port:database:login_name:passwd:table
+#database_out=file:aide.db.new
+database_out=file:@@{DBDIR}/aide.db.new.gz
+
+# Whether to gzip the output to database
+gzip_dbout=yes
+
+# Default.
+verbose=5
+
+report_url=file:@@{LOGDIR}/aide.log
+report_url=stdout
+#report_url=stderr
+#NOT IMPLEMENTED report_url=mailto:root@foo.com
+#NOT IMPLEMENTED report_url=syslog:LOG_AUTH
+
+# These are the default rules.
+#
+#p:      permissions
+#i:      inode:
+#n:      number of links
+#u:      user
+#g:      group
+#s:      size
+#b:      block count
+#m:      mtime
+#a:      atime
+#c:      ctime
+#S:      check for growing size
+#acl:           Access Control Lists
+#selinux        SELinux security context
+#xattrs:        Extended file attributes
+#md5:    md5 checksum
+#sha1:   sha1 checksum
+#sha256:        sha256 checksum
+#sha512:        sha512 checksum
+#rmd160: rmd160 checksum
+#tiger:  tiger checksum
+
+#haval:  haval checksum (MHASH only)
+#gost:   gost checksum (MHASH only)
+#crc32:  crc32 checksum (MHASH only)
+#whirlpool:     whirlpool checksum (MHASH only)
+
+#R:             p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
+#L:             p+i+n+u+g+acl+selinux+xattrs
+#E:             Empty group
+#>:             Growing logfile p+u+g+i+n+S+acl+selinux+xattrs
+
+# You can create custom rules like this.
+# With MHASH...
+# ALLXTRAHASHES = sha1+rmd160+sha256+sha512+whirlpool+tiger+haval+gost+crc32
+ALLXTRAHASHES = sha1+rmd160+sha256+sha512+tiger
+# Everything but access time (Ie. all changes)
+EVERYTHING = R+ALLXTRAHASHES
+
+# Sane
+# NORMAL = R+sha512
+NORMAL = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha512
+
+# For directories, don't bother doing hashes
+DIR = p+i+n+u+g+acl+selinux+xattrs
+
+# Access control only
+PERMS = p+u+g+acl+selinux+xattrs
+
+# Logfile are special, in that they often change
+LOG = p+u+g+n+S+acl+selinux+xattrs
+
+# Content + file type.
+CONTENT = sha512+ftype
+
+# Extended content + file type + access.
+CONTENT_EX = sha512+ftype+p+u+g+n+acl+selinux+xattrs
+
+# Some files get updated automatically, so the inode/ctime/mtime change
+# but we want to know when the data inside them changes
+DATAONLY =  p+n+u+g+s+acl+selinux+xattrs+sha512
+
+# Next decide what directories/files you want in the database.
+
+/boot       CONTENT_EX
+/opt        CONTENT
+
+# Admins dot files constantly change, just check perms
+/root/\..* PERMS
+!/root/.xauth*
+# Otherwise get all of /root.
+/root   CONTENT_EX
+
+# These are too volatile
+!/usr/src
+!/usr/tmp
+!/root/.ansible*
+
+# Otherwise get all of /usr.
+/usr    CONTENT_EX
+
+# trusted databases
+/etc/hosts$      CONTENT_EX
+/etc/host.conf$  CONTENT_EX
+/etc/hostname$   CONTENT_EX
+/etc/issue$      CONTENT_EX
+/etc/issue.net$  CONTENT_EX
+/etc/protocols$  CONTENT_EX
+/etc/services$   CONTENT_EX
+/etc/localtime$  CONTENT_EX
+/etc/alternatives CONTENT_EX
+/etc/sysconfig   CONTENT_EX
+/etc/mime.types$ CONTENT_EX
+/etc/terminfo    CONTENT_EX
+/etc/exports$    CONTENT_EX
+/etc/fstab$      CONTENT_EX
+/etc/passwd$     CONTENT_EX
+/etc/group$      CONTENT_EX
+/etc/gshadow$    CONTENT_EX
+/etc/shadow$     CONTENT_EX
+/etc/subgid$     CONTENT_EX
+/etc/subuid$     CONTENT_EX
+/etc/security/opasswd$ CONTENT_EX
+/etc/skel        CONTENT_EX
+/etc/sssd        CONTENT_EX
+/etc/machine-id$ CONTENT_EX
+/etc/swid        CONTENT_EX
+/etc/system-release-cpe$ CONTENT_EX
+/etc/shells$     CONTENT_EX
+/etc/tmux.conf$  CONTENT_EX
+/etc/xattr.conf$ CONTENT_EX
+
+# networking
+/etc/firewalld      CONTENT_EX
+!/etc/NetworkManager/system-connections
+/etc/NetworkManager CONTENT_EX
+/etc/networks$ CONTENT_EX
+/etc/dhcp CONTENT_EX
+/etc/wpa_supplicant CONTENT_EX
+/etc/resolv.conf$ DATAONLY
+/etc/nscd.conf$ CONTENT_EX
+
+# logins and accounts
+/etc/login.defs$ CONTENT_EX
+/etc/libuser.conf$ CONTENT_EX
+/var/log/faillog$ PERMS
+/var/log/lastlog$ PERMS
+/var/run/faillock PERMS
+/etc/pam.d CONTENT_EX
+/etc/security CONTENT_EX
+/etc/securetty$ CONTENT_EX
+/etc/polkit-1 CONTENT_EX
+/etc/sudo.conf$ CONTENT_EX
+/etc/sudoers$ CONTENT_EX
+/etc/sudoers.d CONTENT_EX
+
+# Shell/X startup files
+/etc/profile$ CONTENT_EX
+/etc/profile.d CONTENT_EX
+/etc/bashrc$ CONTENT_EX
+/etc/bash_completion.d CONTENT_EX
+/etc/zprofile$ CONTENT_EX
+/etc/zshrc$ CONTENT_EX
+/etc/zlogin$ CONTENT_EX
+/etc/zlogout$ CONTENT_EX
+/etc/X11 CONTENT_EX
+
+# Pkg manager
+/etc/dnf CONTENT_EX
+/etc/yum.conf$ CONTENT_EX
+/etc/yum CONTENT_EX
+/etc/yum.repos.d CONTENT_EX
+
+# This gets new/removes-old filenames daily
+!/var/log/sa
+# As we are checking it, we've truncated yesterdays size to zero.
+!/var/log/aide.log
+
+# auditing
+# AIDE produces an audit record, so this becomes perpetual motion.
+/var/log/audit PERMS
+/etc/audit CONTENT_EX
+/etc/libaudit.conf$ CONTENT_EX
+/etc/aide.conf$  CONTENT_EX
+
+# System logs
+/etc/rsyslog.conf$ CONTENT_EX
+/etc/rsyslog.d CONTENT_EX
+/etc/logrotate.conf$ CONTENT_EX
+/etc/logrotate.d CONTENT_EX
+/etc/systemd/journald.conf$ CONTENT_EX
+/var/log LOG+ANF+ARF
+/var/run/utmp LOG
+
+# secrets
+/etc/pkcs11 CONTENT_EX
+/etc/pki CONTENT_EX
+/etc/crypto-policies CONTENT_EX
+/etc/certmonger CONTENT_EX
+/var/lib/systemd/random-seed$ PERMS
+
+# init system
+/etc/systemd CONTENT_EX
+/etc/rc.d CONTENT_EX
+/etc/tmpfiles.d CONTENT_EX
+
+# boot config
+/etc/default CONTENT_EX
+/etc/grub.d CONTENT_EX
+/etc/dracut.conf$ CONTENT_EX
+/etc/dracut.conf.d CONTENT_EX
+
+# glibc linker
+/etc/ld.so.cache$ CONTENT_EX
+/etc/ld.so.conf$ CONTENT_EX
+/etc/ld.so.conf.d CONTENT_EX
+/etc/ld.so.preload$ CONTENT_EX
+
+# kernel config
+/etc/sysctl.conf$ CONTENT_EX
+/etc/sysctl.d CONTENT_EX
+/etc/modprobe.d CONTENT_EX
+/etc/modules-load.d CONTENT_EX
+/etc/depmod.d CONTENT_EX
+/etc/udev CONTENT_EX
+/etc/crypttab$ CONTENT_EX
+
+#### Daemons ####
+
+# cron jobs
+/etc/at.allow$ CONTENT
+/etc/at.deny$ CONTENT
+/etc/anacrontab$ CONTENT_EX
+/etc/cron.allow$ CONTENT_EX
+/etc/cron.deny$ CONTENT_EX
+/etc/cron.d CONTENT_EX
+/etc/cron.daily CONTENT_EX
+/etc/cron.hourly CONTENT_EX
+/etc/cron.monthly CONTENT_EX
+/etc/cron.weekly CONTENT_EX
+/etc/crontab$ CONTENT_EX
+/var/spool/cron/root CONTENT
+
+# time keeping
+/etc/chrony.conf$ CONTENT_EX
+/etc/chrony.keys$ CONTENT_EX
+
+# mail
+/etc/aliases$ CONTENT_EX
+/etc/aliases.db$ CONTENT_EX
+/etc/postfix CONTENT_EX
+
+# ssh
+/etc/ssh/sshd_config$ CONTENT_EX
+/etc/ssh/ssh_config$ CONTENT_EX
+
+# stunnel
+/etc/stunnel CONTENT_EX
+
+# printing
+/etc/cups CONTENT_EX
+/etc/cupshelpers CONTENT_EX
+/etc/avahi CONTENT_EX
+
+# web server
+/etc/httpd CONTENT_EX
+
+# dns
+/etc/named CONTENT_EX
+/etc/named.conf$ CONTENT_EX
+/etc/named.iscdlv.key$ CONTENT_EX
+/etc/named.rfc1912.zones$ CONTENT_EX
+/etc/named.root.key$ CONTENT_EX
+
+# xinetd
+/etc/xinetd.conf$ CONTENT_EX
+/etc/xinetd.d CONTENT_EX
+
+# IPsec
+/etc/ipsec.conf$ CONTENT_EX
+/etc/ipsec.secrets$ CONTENT_EX
+/etc/ipsec.d CONTENT_EX
+
+# USB guard
+/etc/usbguard CONTENT_EX
+
+# Ignore some files
+!/etc/mtab$
+!/etc/.*~
+
+# Now everything else
+/etc    PERMS
+
+# With AIDE's default verbosity level of 5, these would give lots of
+# warnings upon tree traversal. It might change with future version.
+#
+#=/lost\+found    DIR
+#=/home           DIR

templates/foo.conf.j2

@@ -3,7 +3,7 @@
 # Example of a template of configuration file
 #
 {{ ansible_managed | comment }}
-{{ "system_role:template" | comment(prefix="", postfix="") }}
+{{ "system_role:aide" | comment(prefix="", postfix="") }}
 [foo]
 foo = {{ template_foo }}
 bar = {{ template_bar }}

tests/tests_default.yml

@@ -9,5 +9,5 @@
     - name: Check header for ansible_managed, fingerprint
       include_tasks: tasks/check_header.yml
       vars:
-        __file: /etc/foo.conf
+        __file: /etc/aide.conf
         __fingerprint: system_role:aide

vars/Fedora.yml

@@ -3,5 +3,5 @@
 # Put internal variables here with Fedora specific values.
 
 # Example:
-__template_packages: []
+__aide_packages: []
-__template_services: []
+__aide_services: []

vars/RedHat_10.yml

@@ -3,5 +3,5 @@
 # Put internal variables here with Red Hat Enterprise Linux 10 specific values.
 
 # Example:
-__template_packages: []
+__aide_packages: []
-__template_services: []
+__aide_services: []

vars/RedHat_7.yml

@@ -3,5 +3,5 @@
 # Put internal variables here with Red Hat Enterprise Linux 7 specific values.
 
 # Example:
-__template_packages: []
+__aide_packages: []
-__template_services: []
+__aide_services: []

vars/RedHat_8.yml

@@ -3,5 +3,5 @@
 # Put internal variables here with Red Hat Enterprise Linux 8 specific values.
 
 # Example:
-__template_packages: []
+__aide_packages: []
-__template_services: []
+__aide_services: []

vars/RedHat_9.yml

@@ -3,5 +3,5 @@
 # Put internal variables here with Red Hat Enterprise Linux 9 specific values.
 
 # Example:
-__template_packages: []
+__aide_packages: []
-__template_services: []
+__aide_services: []

vars/main.yml

@@ -5,9 +5,10 @@
 # value in a platform/version specific file in vars/
 
 # Examples of non-distribution specific (generic) internal variables:
-__aide_foo_config: foo.conf
+__aide_config: aide.conf
-__aide_packages: []
+__aide_packages: ['aide']
-__aide_services: []
+__aide_db_name: /var/lib/aide/aide.db.gz
+__aide_db_new_name: /var/lib/aide/aide.db.new.gz
 # ansible_facts required by the role
 __aide_required_facts:
   - distribution
@@ -35,5 +36,6 @@ __aide_rh_distros_fedora: "{{ __aide_rh_distros + ['Fedora'] }}"
 __aide_is_rh_distro: "{{ ansible_distribution in __aide_rh_distros }}"
 
 # Use this in conditionals to check if distro is Red Hat or clone, or Fedora
-__aide_is_rh_distro_fedora: "{{ ansible_distribution in __aide_rh_distros_fedora }}"
+__aide_is_rh_distro_fedora: \
+  "{{ ansible_distribution in __aide_rh_distros_fedora }}"
 # END - DO NOT EDIT THIS BLOCK - rh distros variables