Adjust ansible_audit_augenrules_add_syscall_rule to 600

[Mab879]

Description:

Adjust ansible_audit_augenrules_add_syscall_rule to 600

Rationale:

Fixes #12766

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff.
Due to the excessive size of the diff, it has been trimmed to fit the 65535-character limit.

Click here to see the trimmed diff

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open
@@ -101,6 +101,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -147,6 +148,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -239,6 +241,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -285,6 +288,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_open_by_handle_at
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_group_openat
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open
@@ -101,6 +101,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -147,6 +148,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -239,6 +241,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -285,6 +288,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_open_by_handle_at
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_gshadow_openat
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open
@@ -101,6 +101,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -147,6 +148,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -239,6 +241,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -285,6 +288,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_open_by_handle_at
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_passwd_openat
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open
@@ -101,6 +101,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -147,6 +148,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -239,6 +241,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -285,6 +288,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_open_by_handle_at
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat
+++ xccdf_org.ssgproject.content_rule_audit_rules_etc_shadow_openat
@@ -100,6 +100,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -146,6 +147,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -237,6 +239,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -283,6 +286,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_media_export' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_media_export
+++ xccdf_org.ssgproject.content_rule_audit_rules_media_export
@@ -112,6 +112,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -158,6 +159,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -255,6 +257,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -301,6 +304,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification
+++ xccdf_org.ssgproject.content_rule_audit_rules_networkconfig_modification
@@ -110,6 +110,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -157,6 +158,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -253,6 +255,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -300,6 +303,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_directory_access_var_log_audit' differs.
--- xccdf_org.ssgproject.content_rule_directory_access_var_log_audit
+++ xccdf_org.ssgproject.content_rule_directory_access_var_log_audit
@@ -78,6 +78,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -123,6 +124,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod
@@ -112,6 +112,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -161,6 +162,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -260,6 +262,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -309,6 +312,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown
@@ -113,6 +113,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -163,6 +164,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -263,6 +265,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -313,6 +316,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmod
@@ -111,6 +111,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -160,6 +161,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -258,6 +260,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -307,6 +310,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchmodat
@@ -111,6 +111,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -160,6 +161,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -258,6 +260,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -307,6 +310,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchown
@@ -112,6 +112,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -162,6 +163,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -261,6 +263,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -311,6 +314,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fchownat
@@ -112,6 +112,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -162,6 +163,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -261,6 +263,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -311,6 +314,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fremovexattr
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -166,6 +167,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -243,6 +245,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -294,6 +297,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -395,6 +399,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -447,6 +452,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -524,6 +530,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -575,6 +582,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_fsetxattr
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -166,6 +167,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -243,6 +245,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -294,6 +297,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -395,6 +399,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -447,6 +452,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -524,6 +530,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -575,6 +582,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lchown
@@ -113,6 +113,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -163,6 +164,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -263,6 +265,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -313,6 +316,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lremovexattr
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -166,6 +167,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -243,6 +245,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -294,6 +297,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -395,6 +399,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -447,6 +452,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -524,6 +530,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -575,6 +582,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_lsetxattr
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -166,6 +167,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -243,6 +245,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -294,6 +297,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -395,6 +399,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -447,6 +452,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -524,6 +530,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -575,6 +582,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_removexattr
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -166,6 +167,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -243,6 +245,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -294,6 +297,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -395,6 +399,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -447,6 +452,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -524,6 +530,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -575,6 +582,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_setxattr
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -166,6 +167,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -243,6 +245,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -294,6 +297,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -395,6 +399,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -447,6 +452,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -524,6 +530,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -575,6 +582,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount
@@ -72,6 +72,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -118,6 +119,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2
+++ xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_umount2
@@ -90,6 +90,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -136,6 +137,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -222,6 +224,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -268,6 +271,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl
@@ -73,6 +73,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -118,6 +119,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl
@@ -73,6 +73,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -118,6 +119,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon
@@ -78,6 +78,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -123,6 +124,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon
@@ -77,6 +77,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -122,6 +123,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage
@@ -79,6 +79,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -124,6 +125,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles
@@ -77,6 +77,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -122,6 +123,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool
@@ -78,6 +78,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -123,6 +124,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare
+++ xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare
@@ -76,6 +76,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -121,6 +122,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename
+++ xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rename
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -165,6 +166,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -266,6 +268,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -317,6 +320,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat
+++ xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_renameat
@@ -113,6 +113,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -164,6 +165,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -264,6 +266,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -315,6 +318,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir
+++ xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_rmdir
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -165,6 +166,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -266,6 +268,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -317,6 +320,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink
+++ xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlink
@@ -114,6 +114,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -165,6 +166,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -266,6 +268,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -317,6 +320,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat
+++ xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events_unlinkat
@@ -113,6 +113,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -164,6 +165,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -264,6 +266,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -315,6 +318,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod
+++ xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chmod
@@ -103,6 +103,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -155,6 +156,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -251,6 +253,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -303,6 +306,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -400,6 +404,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -452,6 +457,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -548,6 +554,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -600,6 +607,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown
+++ xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_chown
@@ -101,6 +101,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -151,6 +152,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -245,6 +247,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -295,6 +298,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -390,6 +394,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -440,6 +445,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -534,6 +540,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -584,6 +591,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat' differs.
--- xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat
+++ xccdf_org.ssgproject.content_rule_audit_rules_unsuccessful_file_modification_creat
@@ -111,6 +111,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -163,6 +164,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -263,6 +265,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}
@@ -315,6 +318,7 @@
       line: \1\2\3{{ missing_syscalls | join("\3") }}\4
       backrefs: true
       state: present
+      mode: g-rwx,o-rwx
     when: syscalls_found | length > 0 and missing_syscalls | length > 0
 
   - name: Add the audit rule to {{ audit_file }}

... The diff is trimmed here ...

[Mab879]

/packit retest-failed

[vojtapolasek]

Looks good @Mab879 is this the only case in the 10-ansible.jinja where this needs to be fixed? I think I see more.

[codeclimate]

Code Climate has analyzed commit 8f6ab94 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.8% (0.1% change).

View more on Code Climate.