From 154959af62d1aff835b9b63ca69797b07c61da80 Mon Sep 17 00:00:00 2001
From: "root@DERVISHx" <nuno.carvalho@siemens.com>
Date: Thu, 12 Oct 2023 16:07:46 +0100
Subject: [PATCH] Adding new entry in /etc/pam.d/system-auth

Signed-off-by: root@DERVISHx <nuno.carvalho@siemens.com>
---
 tasks/section_5/cis_5.6.x.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tasks/section_5/cis_5.6.x.yml b/tasks/section_5/cis_5.6.x.yml
index 7379f3f..15f1a78 100644
--- a/tasks/section_5/cis_5.6.x.yml
+++ b/tasks/section_5/cis_5.6.x.yml
@@ -98,6 +98,12 @@
             regexp: '^USERGROUPS_ENAB'
             line: USERGROUPS_ENAB no
 
+     - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Force umask sessions /etc/pam.d/system-auth"
+        ansible.builtin.lineinfile:
+            path: /etc/pam.d/system-auth
+            line: 'session     required            pam_umask.so'
+            insertafter: EOF
+
   when:
       - rhel9cis_rule_5_6_5
   tags: