Fixing issue https://github.com/ansible-lockdown/AMAZON2023-CIS/issues/26

[DianaMariaDDM]

Overall Review of Changes:
This PR contains the solution for issue 26

Issue Fixes:

• Rule 4.6.5 needs some fixes in order to be CIS compliant #26

Enhancements:
None

How has this been tested?:
Tested locally.

[mfortin]

umask can be 0027 or 027
should check for lines without comments
no need for capture group

Suggested change

	regexp: '(?i)(umask\s*\d\d\d)'
	regexp: '(?i)^\s*umask\s*\d{3,4}'

[uk-bolly]

Agreed this should be able to capture both types 3 & 4

[mfortin]

And the ^\s* ensure the line starts with umask, and the line is not commented out

[DianaMariaDDM]

I see, I will add these modifications!

[mfortin]

Suggested change

	regexp: '\s+umask\s*\d\d\d'
	regexp: '^\s*umask\s*\d{3,4}'

[DianaMariaDDM]

I will modify this as well, thank you for your input!

[mfortin]

why add a new line ?

Suggested change

	replace: '\numask 027'
	replace: 'umask 027'

[DianaMariaDDM]

As I presented in the issue responsible for this PR:
"Actual Behavior
Firstly, [...]
Secondly, the way the task is written, it does not edit the /etc/bashrc file in a proper manner, only modifying one of
the
umask lines, not all of them."

The only way it worked for my tests was to add 'umask 027' with \n in order to edit properly both umask lines from /etc/bashrc.

[mfortin]

I am sure this would get you where you want too.

ansible.builtin.replace:
            path: /etc/bashrc
            regexp: '^(\s+umask\s*)\d\d\d'
            replace: '\1 027'

[DianaMariaDDM]

I tried you approach but unfortunately, it did not work. This is the content of the /etc/bashrc file after executing the task with replace: '\1 027':

Using \numask 027 still works fine and modifies all the lines with umask.

[uk-bolly]

Does this work?

This should only change those not 027 or more restrictive and whether 3 or 4 characters

regexp: '^(?i)(\s*umask)\s+(?\!\d*[2,7]7)\d{3,4}'
replace: '\1 027'

[uk-bolly]

Just ran manually on bashrc

grep -i umask /etc/bashrc
    # By default, we want umask to get set. This sets it for non-login shell.
       umask 002
       umask 022
[ec2-user@test ~]$ cp -p /etc/bashrc /etc/bashrc_orig
cp: cannot create regular file '/etc/bashrc_orig': Permission denied
[ec2-user@test ~]$ sudo cp -p /etc/bashrc /etc/bashrc_orig
[ec2-user@test ~]$ grep -i umask /etc/bashrc
    # By default, we want umask to get set. This sets it for non-login shell.
       umask 027
       umask 027

Just checking we're in the same place i'm using this regexp

ansible.builtin.replace:
    path: /etc/bashrc
    regexp: ^(?i)(\s*umask)\s+(?!\d*[2,7]7)\d{3,4}
    replace: '\1 027'

p.s. i did forget to sudo :)

[DianaMariaDDM]

I used the same regexp as well, still, it did not modify the lines...

[uk-bolly]

Ok lets close this PR i will add the fix to the new Feb24 ive been working on, there seems to be so many commits for one line change for this control.
Let see if we reset and how we get on then, i have a feeling something is not quite right somewhere.

[DianaMariaDDM]

I agree! Thank you for your time!

[uk-bolly]

Not a problem at all, will ensure credit added for the update
thank you for the time