Update cis_4.6.x.yml

Avoid capturing commented out lines. Removed parenthesis as the capture group is not used, so those were not required. Signed-off-by: Math Fortin <[email protected]>
ansible-lockdown · Jan 22, 2024 · 5c57162 · 5c57162
1 parent 665d22b
commit 5c57162
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/tasks/section_4/cis_4.6.x.yml b/tasks/section_4/cis_4.6.x.yml
@@ -92,7 +92,7 @@
       - name: "4.6.5 | PATCH | Ensure default user umask is 027 or more restrictive | Set umask for /etc/login.defs pam_umask settings"
         ansible.builtin.lineinfile:
             path: "{{ item.path }}"
-            regexp: '(?i)(umask\s*)'
+            regexp: '(?i)^\s*umask\s*'
             line: '{{ item.line }} 027'
         with_items:
             - { path: '/etc/bashrc', line: 'umask' }