Fixing https://github.com/ansible-lockdown/AMAZON2023-CIS/issues/36

[DianaMariaDDM]

Overall Review of Changes:
This PR contains the solution for this issue.

Issue Fixes:

• Rule 6.1.10 fails because the command does not retrieve the necessary files #36

Enhancements:
None.

How has this been tested?:
Locally.

[uk-bolly]

While i understand the issue, this change means that this could be searching any shared mounted drives which on shared systems may introduce major issues for some systems and configurations.
Passing it through the df with xargs allows us to separate those filesystems not part of the same device ID thereby excluding things like /sys and /proc.
Its current state allows it to run on most systems with local disk, it doesn't always allow for systems with multiple disks, again the impact on shared environments could have a very bad adverse effect.
Trying to minimise any possible impact we could change this to add a couple of extra excludes using grep at the end of the command.
e.g.
df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find '{}' -xdev -type f -perm -0002 | grep -Ev "/snap|/containerd|/kubelet"
This allows greater control and having tested across a few different OSs seems to be a consistent output.
We could also add a variable if we wanted to allow users to defined their own filesystems to be excluded.

[DianaMariaDDM]

I would try to modify the command by adding the exceptions in the find part of the command like this:

df --local -P | awk {'if (NR!=1) print $6'} | xargs -I '{}' find \( ! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "/sys/kernel/security/apparmor/*" -a ! -path "/snap/*" -a ! -path "/sys/fs/cgroup/memory*" -a ! -path "/sys/fs/selinux/*" \) -xdev -type f -perm -0002

[uk-bolly]

the -xdev means that the filesystems /sys /run and /proc wouldn't be looked at anyway, so those in the ! -path matching those filesystems wouldn't be needed.

[DianaMariaDDM]

Sorry, about this, I overlooked it. I will push the modification asap!

[uk-bolly]

hi @DianaMariaDDM

Thank you again for you issues and PRs and all the work, i know we have seen this previously with one file being changes but having multiple commits being added. I believe this is the same issue that one of your colleagues is having.
If there is only one change that you wish to make we should only see that one change not the syncing of the commits we do see. Not sure how that happens, but it can cause issues and take alot longer for us to confirm all the changes in your PR.
I believe quite a few of the issues have been addressed now and merged.

If you could please check and close if this is done.

Many thanks and apologies for any confusion.

uk-bolly