diff --git a/cfg/ack-1.0/node.yaml b/cfg/ack-1.0/node.yaml index 961dbcd..3872880 100644 --- a/cfg/ack-1.0/node.yaml +++ b/cfg/ack-1.0/node.yaml @@ -25,14 +25,16 @@ groups: - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root + - flag: "File not found" remediation: | - Run the below command (based on the file location on your system) on the each worker node. - For example, - chown root:root $kubeletsvc + Run the below command (based on the file location on your system) on the each worker node. + For example, + chown root:root $kubeletsvc scored: true - id: 4.1.3 diff --git a/cfg/cis-1.20/node.yaml b/cfg/cis-1.20/node.yaml index 72524ae..f2afb76 100644 --- a/cfg/cis-1.20/node.yaml +++ b/cfg/cis-1.20/node.yaml @@ -25,14 +25,16 @@ groups: - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root + - flag: "File not found" remediation: | - Run the below command (based on the file location on your system) on the each worker node. - For example, - chown root:root $kubeletsvc + Run the below command (based on the file location on your system) on the each worker node. + For example, + chown root:root $kubeletsvc scored: true - id: 4.1.3 diff --git a/cfg/cis-1.23/node.yaml b/cfg/cis-1.23/node.yaml index 3105d37..affdbf9 100644 --- a/cfg/cis-1.23/node.yaml +++ b/cfg/cis-1.23/node.yaml @@ -24,14 +24,16 @@ groups: - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root + - flag: "File not found" remediation: | - Run the below command (based on the file location on your system) on the each worker node. - For example, - chown root:root $kubeletsvc + Run the below command (based on the file location on your system) on the each worker node. + For example, + chown root:root $kubeletsvc scored: true - id: 4.1.3 diff --git a/cfg/cis-1.24/node.yaml b/cfg/cis-1.24/node.yaml index f85d7ce..3649428 100644 --- a/cfg/cis-1.24/node.yaml +++ b/cfg/cis-1.24/node.yaml @@ -24,14 +24,16 @@ groups: - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root + - flag: "File not found" remediation: | - Run the below command (based on the file location on your system) on the each worker node. - For example, - chown root:root $kubeletsvc + Run the below command (based on the file location on your system) on the each worker node. + For example, + chown root:root $kubeletsvc scored: true - id: 4.1.3 diff --git a/cfg/cis-1.5/node.yaml b/cfg/cis-1.5/node.yaml index fe47d64..8823598 100644 --- a/cfg/cis-1.5/node.yaml +++ b/cfg/cis-1.5/node.yaml @@ -25,16 +25,17 @@ groups: scored: true - id: 4.1.2 - text: "Ensure that the kubelet service file ownership is set to root:root (Scored)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root - set: true + - flag: "File not found" remediation: | - Run the below command (based on the file location on your system) on the each worker node. - For example, - chown root:root $kubeletsvc + Run the below command (based on the file location on your system) on the each worker node. + For example, + chown root:root $kubeletsvc scored: true - id: 4.1.3 diff --git a/cfg/cis-1.6/node.yaml b/cfg/cis-1.6/node.yaml index e396415..157eecc 100644 --- a/cfg/cis-1.6/node.yaml +++ b/cfg/cis-1.6/node.yaml @@ -25,10 +25,12 @@ groups: - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root + - flag: "File not found" remediation: | Run the below command (based on the file location on your system) on the each worker node. For example, diff --git a/cfg/cis-1.7/node.yaml b/cfg/cis-1.7/node.yaml index e109d41..de1c29c 100644 --- a/cfg/cis-1.7/node.yaml +++ b/cfg/cis-1.7/node.yaml @@ -24,14 +24,16 @@ groups: - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root + - flag: "File not found" remediation: | - Run the below command (based on the file location on your system) on the each worker node. - For example, - chown root:root $kubeletsvc + Run the below command (based on the file location on your system) on the each worker node. + For example, + chown root:root $kubeletsvc scored: true - id: 4.1.3 diff --git a/cfg/cis-1.8/node.yaml b/cfg/cis-1.8/node.yaml index 04f4270..66e7697 100644 --- a/cfg/cis-1.8/node.yaml +++ b/cfg/cis-1.8/node.yaml @@ -24,14 +24,16 @@ groups: - id: 4.1.2 text: "Ensure that the kubelet service file ownership is set to root:root (Automated)" - audit: '/bin/sh -c ''if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; fi'' ' + audit: '/bin/sh -c "if test -e $kubeletsvc; then stat -c %U:%G $kubeletsvc; else echo \"File not found\"; fi"' tests: + bin_op: or test_items: - flag: root:root + - flag: "File not found" remediation: | - Run the below command (based on the file location on your system) on the each worker node. - For example, - chown root:root $kubeletsvc + Run the below command (based on the file location on your system) on the each worker node. + For example, + chown root:root $kubeletsvc scored: true - id: 4.1.3