75 lines
2 KiB
YAML
75 lines
2 KiB
YAML
---
|
|
|
|
- name: Reboot after panic
|
|
sysctl:
|
|
name: "{{ item.name }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
with_items:
|
|
- { name: kernel.panic_on_oops, value: 1 }
|
|
- { name: kernel.panic, value: 60 }
|
|
when: evolinux_kernel_reboot_after_panic
|
|
|
|
- name: Don't reboot after panic
|
|
sysctl:
|
|
name: "{{ item }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: absent
|
|
reload: yes
|
|
with_items:
|
|
- kernel.panic_on_oops
|
|
- kernel.panic
|
|
when: not evolinux_kernel_reboot_after_panic
|
|
|
|
- name: Disable net.ipv4.tcp_timestamps
|
|
sysctl:
|
|
name: net.ipv4.tcp_timestamps
|
|
value: 0
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
when: evolinux_kernel_disable_tcp_timestamps
|
|
|
|
- name: "Check for swapiness value"
|
|
assert:
|
|
that:
|
|
- evolinux_kernel_swapiness_level >= 0
|
|
- evolinux_kernel_swapiness_level < 100
|
|
msg: swapiness level should be >= 0 and < 100
|
|
|
|
|
|
- name: Reduce the swapiness
|
|
sysctl:
|
|
name: vm.swappiness
|
|
value: "{{ evolinux_kernel_swapiness_level }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
when: evolinux_kernel_reduce_swapiness
|
|
|
|
- name: Patch for TCP stack vulnerability CVE-2016-5696
|
|
sysctl:
|
|
name: net.ipv4.tcp_challenge_ack_limit
|
|
value: 1073741823
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
when: evolinux_kernel_cve20165696
|
|
|
|
- name: Patch for TCP stack vulnerability CVE-2018-5391 (FragmentSmack)
|
|
sysctl:
|
|
name: "{{ item.name }}"
|
|
value: "{{ item.value }}"
|
|
sysctl_file: "{{ evolinux_kernel_sysctl_path }}"
|
|
state: present
|
|
reload: yes
|
|
with_items:
|
|
- { name: "net.ipv4.ipfrag_low_thresh", value: 196608 }
|
|
- { name: "net.ipv6.ip6frag_low_thresh", value: 196608 }
|
|
- { name: "net.ipv4.ipfrag_high_thresh", value: 262144 }
|
|
- { name: "net.ipv6.ip6frag_high_thresh", value: 262144 }
|
|
|
|
- meta: flush_handlers
|