Hello, i have a question, in CIS Security hardening there is check that says that umask should be 027 and i have a situation where on RHEL 8 in files /etc/profile /etc/bashrc i have two similar lines which defines umask and i added file_line puppet resource, it replaced fist line but the second line were NOT replaced (attached a few screenshots). What would you recommend?

My guess is that it runs the first file_line and then, after inserting a

umask 027

it finds the 027 when running the second file_line and thinks the work is already done. Have you tried running one

file_line

with multiple matches?

Just to clarify, you mean to specify not "umask 022" and "umask 002", but something like "umask 0" (wildcard) that will match two lines and then see if it will work?

I'm not skilled enough here to really know the exact syntax, so I pulled up Claude Code to try to get the syntax... but my idea was something like this:

['/etc/profile', '/etc/bashrc'].each |String $file| {
  file_line { "umask_${file}":
    path     => $file,
    match    => '^\s*umask\s+0(02|22)$',
    line     => '    umask 027',
    multiple => true,
  }
}

Checked - it didn't worked as well - second line/entry remained unchanged. So i guess only way left is to use exec resource and there use standard linux commands to work with text