5.4.4 | Ensure default user umask is 027 or more restrictive task assumes umask already present in bash.rc

[jrbeilke]

The task for this CIS criteria uses replace assuming that there is already a umask setting in /etc/bash.bashrc and /etc/profile, but does not add the umask setting if it's missing (seems to be missing in bash.rc on a fresh Ubuntu 18.04 install) ie.

- name: "SCORED | 5.4.4 | PATCH | Ensure default user umask is 027 or more restrictive"
  replace:
      path: "{{ item }}"
      regexp: '(^\s+umask) 002'
      replace: '\1 027'
  with_items:
      - /etc/bash.bashrc
      - /etc/profile

An update is needed to ensure that the proper umask setting is added to these files if one does not already exist.

[jrbeilke]

FYI here is an example from the GSA how they handle this criteria in their role using lineinfile:
https://github.com/GSA/ansible-os-ubuntu18/blob/master/tasks/section5.yml#L731

    - name: "SCORED | 5.4.4 | PATCH | Ensure default user umask is 027 or more restrictive - /etc/bash.bashrc"
      lineinfile:
        state: present
        dest: /etc/bash.bashrc
        create: true
        regexp: '^umask '
        line: 'umask 027'