modify audit for check 1.1.8 (#111)

aquasecurity · Aug 22, 2023 · aede567 · aede567
1 parent e377cfe
commit aede567
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/cfg/cis-1.3.1/definitions.yaml b/cfg/cis-1.3.1/definitions.yaml
@@ -119,8 +119,8 @@ groups:
   - id: 1.1.8
     description: "Ensure auditing is configured for Docker files and directories - containerd.sock (Automated)"
     audit: |
-      test_file=$(grep 'containerd.sock' /etc/containerd/config.toml | awk -F "=" '{print $2}')
-      if test -f "$test_file"; then
+      test_file=$(grep 'containerd.sock' /etc/containerd/config.toml | awk -F "\"" '{print $2}')
+      if test -S "$test_file"; then
         auditctl -l | grep $test_file
       fi
     tests: