# platform = multi_platform_all
# reboot = false
# strategy = restrict
# complexity = low
# disruption = low

- (xccdf-var var_sudo_umask)

- name: Ensure umask is enabled with the appropriate value in /etc/sudoers
  ansible.builtin.lineinfile:
    path: /etc/sudoers
    regexp: '^[\s]*Defaults\s(.*)\bumask=[-]?.+\b(.*)$'
    line: 'Defaults \1umask={{ var_sudo_umask }}\2'
    validate: /usr/sbin/visudo -cf %s
    backrefs: yes
  register: edit_sudoers_umask_option

- name: Enable umask option with appropriate value in /etc/sudoers
  ansible.builtin.lineinfile: # noqa 503
    path: /etc/sudoers
    line: 'Defaults umask={{ var_sudo_umask }}'
    validate: /usr/sbin/visudo -cf %s
  when: edit_sudoers_umask_option is defined and not edit_sudoers_umask_option.changed
