updated 5.6.5 logic

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_5/cis_5.6.x.yml

@@ -83,25 +83,21 @@
 - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive"
   block:
       - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/login.defs pam_umask settings"
-        ansible.builtin.replace:
+        ansible.builtin.lineinfile:
-            path: /etc/login.defs
+            path: "{{ item.path }}"
-            regexp: "{{ item.regexp }}"
+            regexp: '(?i)(umask\s*)'
-            replace: "{{ item.replace }}"
+            line: '{{ item.line }} 027'
-        loop:
+        with_items:
-            - { regexp: '(UMASK\s+)0[012][0-6]', replace: '\1 027' }
+            - { path: '/etc/bash.bashrc', line: 'umask' }
-            - { regexp: '(USERGROUPS_ENAB\s+)yes', replace: '\1 no' }
+            - { path: '/etc/profile', line: 'umask' }
+            - { path: '/etc/login.defs', line: 'UMASK' }
 
       - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/bashrc"
-        ansible.builtin.replace:
+        ansible.builtin.lineinfile:
-            path: /etc/bashrc
+            path: /etc/login.defs
-            regexp: '^(?i)(\s+UMASK|UMASK)\s0[0-2][0-6]'
+            regexp: '^USERGROUPS_ENAB'
-            replace: '\1 027'
+            line: USERGROUPS_ENAB no
 
-      - name: "5.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/profile"
-        ansible.builtin.replace:
-            path: /etc/profile
-            regexp: '(?i)(umask)\s0[0-2][0-6]'
-            replace: '\1 027'
   when:
       - rhel9cis_rule_5_6_5
   tags: