6.1.10 thanks to @DianaMariaDDM #37

Signed-off-by: Mark Bolwell <[email protected]>
ansible-lockdown · Feb 23, 2024 · 0326c0b · 0326c0b
1 parent 2511f5a
commit 0326c0b
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/tasks/section_6/cis_6.1.x.yml b/tasks/section_6/cis_6.1.x.yml
@@ -177,7 +177,7 @@
 - name: "6.1.10 | PATCH | Ensure world writable files and directories are secured"
   block:
       - name: "6.1.10 | AUDIT | Ensure world writable files and directories are secured | Get list of world-writable files"
-        ansible.builtin.shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002
+        ansible.builtin.shell: df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find \( ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "/snap/*" \) -xdev -type f -perm -0002
         failed_when: false
         changed_when: false
         register: amzn2023cis_6_1_10_perms_results