Merge pull request #323 from ansible-lockdown/pub_7.1.2_enhance

enhanced 7.1.12 ability to exclude filesystem types variable

Author: frederickw082922

defaults/main.yml

@@ -1314,9 +1314,16 @@ ubtu22cis_dotperm_ansiblemanaged: true
 
 ## Section 7
 
-# 7.1.12 Ensure no files or directories without an owner and a group exist
-ubtu22cis_exclude_unowned_search_path: (! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "*/kubelet/plugins/*" -a ! -path "/sys/fs/cgroup/memory/*" -a ! -path "/var/*/private/*")
-
+# 7.1.12
+# Ensure no files or directories without an owner and a group exist
+# Extend the list as required adding the the current list e.g. "-a ! -path "/somedir/*"
+# Note Ensure to document all exclusions that do not match the benchmark
+ubtu22cis_exclude_unowned_search_path: '\( ! -path "/run/user/*" -a ! -path "/proc/*" -a ! -path "*/containerd/*" -a ! -path "*/kubelet/pods/*" -a ! -path "*/kubelet/plugins/*" -a ! -path "/sys/fs/cgroup/memory/*" -a ! -path "/var/*/private/*" \)'
+
+# This can be extended as seen fit
+# NFS added as starter to be extended with "-a -not -fstype CIFS"
+# Note Ensure to document all exclusions that do not match the benchmark
+ubtu22cis_exclude_unowned_filesystem_types: '\( -not -fstype nfs \)'
 # Control 7.1.12
 # The value of this variable specifies the owner that will be set for unowned files and directories.
 ubtu22cis_unowned_owner: root

tasks/section_7/cis_7.1.x.yml

@@ -220,7 +220,7 @@
     warn_control_id: '7.1.12'
   block:
     - name: "7.1.12 | AUDIT | Ensure no files or directories without an owner and a group exist | Get list files or directories"
-      ansible.builtin.command: 'find {{ ubtu22cis_exclude_unowned_search_path }} {{ item.mount }} -xdev \( -nouser -o -nogroup \) -not -fstype nfs'
+      ansible.builtin.command: find {{ ubtu22cis_exclude_unowned_search_path }} {{ item.mount }} -xdev \( -nouser -o -nogroup \) {{ ubtu22cis_exclude_unowned_filesystem_types }}
       changed_when: false
       failed_when: false
       check_mode: false