[stabilization] Fix accounts_umask_etc_bashrc

[jan-cerny]

This is a port of #11946 to the stabilization-v0.1.73 branch.

Fix accounts_umask_etc_bashrc content misalignment with RHEL 9 DISA STIG.

• Only valid umask values (3-digits) will match in OVAL
• Do not concatenate original value with the new value in Ansible remediation
• Add a regression test for accounts_umask_etc_bashrc is misaligned with RHEL 9 STIG #11937
• Fix bash quoting in test scenario

Fixes: #11937

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc' differs.
--- xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc
+++ xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc
@@ -21,7 +21,7 @@
 - name: Check if umask in /etc/bashrc is already set
   ansible.builtin.lineinfile:
     path: /etc/bashrc
-    regexp: ^[^#]*\bumask\s+
+    regexp: ^[^#]*\bumask\s+\d+$
     state: absent
   check_mode: true
   changed_when: false
@@ -42,8 +42,8 @@
 - name: Replace user umask in /etc/bashrc
   ansible.builtin.replace:
     path: /etc/bashrc
-    regexp: ^([^#]*\b)umask(\s*)
-    replace: \g<1>umask\g<2>{{ var_accounts_user_umask }}
+    regexp: ^([^#]*\b)umask\s+\d+$
+    replace: \g<1>umask {{ var_accounts_user_umask }}
   when:
   - '"bash" in ansible_facts.packages'
   - umask_replace.found > 0

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11957
This image was built from commit: f743af3

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11957

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11957 make deploy-local

[Mab879]

/packit build