---
# After installing securedrop-grsec, remove
# old generic kernels to avoid accidental
# boots into a less secure environment.
- name: Remove generic kernel packages.
  apt:
    name: "{{ item }}"
    state: absent
  with_items:
    - linux-signed-generic
    - linux-signed-generic-lts-utopic
    - linux-signed-image-generic
    - linux-signed-image-generic-lts-utopic
    - 'linux-image-*generic'
    - 'linux-headers-*'
  tags:
    - apt

- name: Mark GRUB2 as manually installed so its not removed.
  command: apt-mark manual grub-pc
  register: grubpc_manual_mark
  changed_when: "'grub-pc was already set to manually installed.' not in grubpc_manual_mark.stdout"
  tags:
    - apt
    - kernel
    - grub

- name: Clean old apt packages.
  command: apt-get -y autoremove
  register: apt_autoremove_all
  changed_when: "'The following packages will be REMOVED' in apt_autoremove_all.stdout"
  tags:
    - apt

---
# After installing securedrop-grsec, remove
# old generic kernels to avoid accidental
# boots into a less secure environment.
- name: Remove generic kernel packages.
  command: apt-get remove -y {{ item }}
  with_items:
    - linux-signed-generic
    - linux-signed-generic-lts-utopic
    - linux-signed-image-generic
    - linux-signed-image-generic-lts-utopic
    - linux-image-generic-lts-xenial
    - 'linux-image-.*generic'
    - 'linux-headers-.*'
  tags:
    - apt

- name: Get list of all installed kernels.
  shell: dpkg-query -f '${Package} ${Status}\n' -W 'linux-image*' | awk '$NF == "installed"{print $1}'
  register: apt_installed_kernels
  tags:
    - apt

- name: Validate that all installed kernels are grsecurity-hardened.
  assert:
    that:
      - item | search('-grsec')
    msg: "Not all non-grsec kernels have been removed, run dpkg-query -W 'linux-image*' for more details."
  with_items: "{{ apt_installed_kernels.stdout_lines }}"
  tags:
    - apt

- name: Mark GRUB2 as manually installed so its not removed.
  command: apt-mark manual grub-pc
  register: grubpc_manual_mark
  changed_when: "'grub-pc was already set to manually installed.' not in grubpc_manual_mark.stdout"
  tags:
    - apt
    - kernel
    - grub

- name: Clean old apt packages.
  command: apt-get -y autoremove
  register: apt_autoremove_all
  changed_when: "'The following packages will be REMOVED' in apt_autoremove_all.stdout"
  tags:
    - apt

Remove xenial kernel at install-time
Remove xenial kernel at install-time

Non-grsec, vanilla Xenial lts kernel was pulled in by trusty security in the initial update phase (at install-time only) was superceeding grsecurity 3.14.xx kernels on reboot. This will ensure the default trusty kernels are correctly removed at install time, and that the system does not boot with that kernel, through misconfiguration or user error. Install playbook now asserts that, at install time, all kernels installed on the system are grsecurity-hardenened.
