Disable FUSE

roles/float-base/tasks/harden.yml

@@ -75,12 +75,15 @@
     name: auditd.service
     enabled: yes
 
-- name: Disable journald-auditd link
+- name: Mask unwanted systemd units
   systemd:
-    name: systemd-journald-audit.socket
+    name: "{{ item }}"
     state: stopped
     enabled: no
     masked: yes
+  loop:
+    - "sys-fs-fuse-connections.mount"
+    - "systemd-journald-audit.socket"
 
 - name: Install lockdown systemd units
   copy:
@@ -98,3 +101,4 @@
   loop:
     - 'float-lockdown.target'
     - 'disable-kmod-load.service'
+