Fancy 3.3.7, fix 5.6.5

tasks/post.yml

@@ -27,18 +27,13 @@
       - "'procps-ng' in ansible_facts.packages"
 
 - name: POST | Update usr sysctl
-  block:
-     - name: POST | Set default.rp_filter
   ansible.builtin.lineinfile:
-        path: /usr/lib/sysctl.d/50-default.conf
-        regexp: '^net.ipv4.conf.default.rp_filter'
-        line: net.ipv4.conf.default.rp_filter = 1
-
-     - name: POST | Set ALL rp_filter
-       ansible.builtin.lineinfile:
-        path: /usr/lib/sysctl.d/50-default.conf
-        regexp: '^net.ipv4.conf.*.rp_filter'
-        line: net.ipv4.conf.*.rp_filter = 1
+      dest: /usr/lib/sysctl.d/50-default.conf
+      regexp: "{{ item.regexp }}"
+      line: "{{ item.line }}"
+  loop:
+      - { regexp: '^net.ipv4.conf.default.rp_filter', line: 'net.ipv4.conf.default.rp_filter = 1' }
+      - { regexp: '^net.ipv4.conf.*.rp_filter', line: 'net.ipv4.conf.*.rp_filter = 1' }
   when:
       - rhel9cis_sysctl_update
       - not system_is_container

tasks/section_5/cis_5.6.x.yml

@@ -101,7 +101,7 @@
       - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Force umask on sessions /etc/pam.d/system-auth"
         ansible.builtin.lineinfile:
             path: /etc/pam.d/system-auth
-            line: 'session\trequired\t\t\tpam_umask.so'
+            line: 'session     required            pam_umask.so'
             insertafter: EOF
   when:
       - rhel9cis_rule_5_6_5