https://github.com/HarryHarcourt/Ansible-RHEL7-CIS-Benchmarks/blob/f5b769109f1e084b4eae149cea2a9453bb182d01/tasks/level-1/4.2.4.yml#L20 This rule turns on the user and group executable bits, as well as group write permissions. Mode 0640 or 0600 would be more appropriate.