perf: optimize slow-running tasks

tasks/aide.yml

@@ -75,75 +75,72 @@
       register: aide_config_d
 
     - name: Add auditd tools
-      ansible.builtin.lineinfile:
+      ansible.builtin.blockinfile:
         path: "{{ '/etc/aide/aide.conf' if ansible_facts.os_family == 'Debian' else '/etc/aide.conf' }}"
         state: "{{ 'absent' if aide_config_d.stat.exists else 'present' }}"
-        regexp: ^[# ]*{{ item }}
-        line: "{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512"
         mode: "0640"
         owner: root
         group: root
         create: false
+        marker: "# {mark} ANSIBLE MANAGED BLOCK - auditd tools"
+        block: |
+          /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512
         validate: aide --config-check --config=%s
-      loop:
-        - /usr/sbin/auditctl
-        - /usr/sbin/auditd
-        - /usr/sbin/ausearch
-        - /usr/sbin/aureport
-        - /usr/sbin/autrace
-        - /usr/sbin/augenrules
-        - /usr/sbin/audispd
       when:
         - not aide_config_d.stat.exists
 
     - name: Add AIDE dir exclusions
-      ansible.builtin.lineinfile:
+      ansible.builtin.blockinfile:
         path: "{{ '/etc/aide/aide.conf' if ansible_facts.os_family == 'Debian' else '/etc/aide.conf' }}"
-        line: "!{{ item }}"
         state: "{{ 'absent' if aide_config_d.stat.exists else 'present' }}"
         mode: "0640"
         owner: root
         group: root
         create: false
+        marker: "# {mark} ANSIBLE MANAGED BLOCK - dir exclusions"
+        block: |
+          {% for dir in aide_dir_exclusions %}
+          !{{ dir }}
+          {% endfor %}
         validate: aide --config-check --config=%s
-      with_items:
-        - "{{ aide_dir_exclusions }}"
       when:
         - not aide_config_d.stat.exists
 
     - name: Add auditd tools in include directory
-      ansible.builtin.lineinfile:
-        path: "{{ aide_include_d }}/99_aide_auditd"
-        state: present
-        line: "{{ item }} p+i+n+u+g+s+b+acl+xattrs+sha512"
+      ansible.builtin.copy:
+        dest: "{{ aide_include_d }}/99_aide_auditd"
         mode: "0640"
         owner: root
         group: root
-        create: true
+        content: |
+          /usr/sbin/auditctl p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/auditd p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/ausearch p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/aureport p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/autrace p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/augenrules p+i+n+u+g+s+b+acl+xattrs+sha512
+          /usr/sbin/audispd p+i+n+u+g+s+b+acl+xattrs+sha512
         validate: aide --config-check --config=%s
-      loop:
-        - /usr/sbin/auditctl
-        - /usr/sbin/auditd
-        - /usr/sbin/ausearch
-        - /usr/sbin/aureport
-        - /usr/sbin/autrace
-        - /usr/sbin/augenrules
-        - /usr/sbin/audispd
       when:
         - aide_config_d.stat.exists
 
-    - name: Add AIDE dir exclusions
-      ansible.builtin.lineinfile:
-        path: "{{ aide_include_d }}/99_aide_exclusions"
-        line: "!{{ item }}"
-        state: present
+    - name: Add AIDE dir exclusions in include directory
+      ansible.builtin.copy:
+        dest: "{{ aide_include_d }}/99_aide_exclusions"
         mode: "0640"
         owner: root
         group: root
-        create: true
+        content: |
+          {% for dir in aide_dir_exclusions %}
+          !{{ dir }}
+          {% endfor %}
         validate: aide --config-check --config=%s
-      with_items:
-        - "{{ aide_dir_exclusions }}"
       when:
         - aide_config_d.stat.exists
 

tasks/kernelmodules.yml

@@ -7,46 +7,43 @@
 
 - name: Blacklist kernel file system modules
   become: true
-  ansible.builtin.lineinfile:
+  ansible.builtin.copy:
     dest: /etc/modprobe.d/disablefs.conf
-    line: blacklist {{ item }}
     mode: "0644"
     owner: root
     group: root
-    state: present
-    create: true
-  with_items:
-    - "{{ fs_modules_blocklist }}"
+    content: |
+      {% for module in fs_modules_blocklist %}
+      blacklist {{ module }}
+      {% endfor %}
 
 - name: Blacklist kernel network modules
   become: true
-  ansible.builtin.lineinfile:
+  ansible.builtin.copy:
     dest: /etc/modprobe.d/disablenet.conf
-    line: blacklist {{ item }}
     mode: "0644"
     owner: root
     group: root
-    state: present
-    create: true
-  with_items:
-    - "{{ net_modules_blocklist }}"
+    content: |
+      {% for module in net_modules_blocklist %}
+      blacklist {{ module }}
+      {% endfor %}
 
 - name: Allow USB kernel modules if USBGuard is used
   ansible.builtin.set_fact:
     misc_modules_usbguard: "{{ misc_modules_blocklist | reject('search', 'usb') | list }}"
 
 - name: Blacklist misc kernel modules
   become: true
-  ansible.builtin.lineinfile:
+  ansible.builtin.copy:
     dest: /etc/modprobe.d/disablemod.conf
-    line: blacklist {{ item }}
     mode: "0644"
     owner: root
     group: root
-    state: present
-    create: true
-  with_items:
-    - "{{ misc_modules_usbguard if manage_usbguard else misc_modules_blocklist }}"
+    content: |
+      {% for module in (misc_modules_usbguard if manage_usbguard else misc_modules_blocklist) %}
+      blacklist {{ module }}
+      {% endfor %}
 
 - name: Stat blacklisted kernel modules
   environment:
@@ -63,13 +60,14 @@
 
 - name: Block blacklisted kernel modules
   become: true
-  ansible.builtin.lineinfile:
+  ansible.builtin.copy:
+    content: |
+      # Blacklisted kernel modules - ansible managed
+      {% for module in modprobe_blacklist.stdout_lines | sort | unique %}
+      install {{ module }} /bin/true
+      {% endfor %}
     dest: /etc/modprobe.d/blacklist-blocked.conf
-    line: install {{ item }} /bin/true
     mode: "0644"
     owner: root
     group: root
-    state: present
-    create: true
-  with_items:
-    - "{{ modprobe_blacklist.stdout_lines | sort | unique }}"
+    backup: true

tasks/password.yml

@@ -180,41 +180,22 @@
     - Update Debian cracklib
     - Update RedHat cracklib
 
-- name: Add local information to password list
-  become: true
-  ansible.builtin.lineinfile:
-    dest: /usr/share/dict/passwords.local
-    mode: "0644"
-    owner: root
-    group: root
-    state: present
-    create: true
-    line: "{{ item }}"
-  notify:
-    - Update Debian cracklib
-    - Update RedHat cracklib
-  loop:
-    - "{{ ansible_facts.hostname | lower }}"
-    - "{{ ansible_facts.os_family | lower }}"
-
 - name: Get all local user accounts
   ansible.builtin.getent:
     database: passwd
   register: local_users
 
-- name: Add local usernames to password list
+- name: Create local password list with system information and usernames
   become: true
-  ansible.builtin.lineinfile:
+  ansible.builtin.copy:
     dest: /usr/share/dict/passwords.local
     mode: "0644"
     owner: root
     group: root
-    state: present
-    create: true
-    line: "{{ item }}"
-  changed_when: false
+    content: |
+      {{ ansible_facts.hostname | lower }}
+      {{ ansible_facts.os_family | lower }}
+      {{ local_users.ansible_facts.getent_passwd | list | join('\n') }}
   notify:
     - Update Debian cracklib
     - Update RedHat cracklib
-  with_items:
-    - "{{ local_users.ansible_facts.getent_passwd | list }}"