updated yamllint, company naming, linting and spacing

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_1/cis_1.1.1.x.yml

@@ -16,7 +16,7 @@
         regexp: "^(#)?install cramfs(\\s|$)"
         line: "install cramfs /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -24,7 +24,7 @@
         regexp: "^(#)?blacklist cramfs(\\s|$)"
         line: "blacklist cramfs"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.1 | PATCH | Ensure cramfs kernel module is not available | Disable cramfs"
       when:
@@ -49,7 +49,7 @@
         regexp: "^(#)?install freevxfs(\\s|$)"
         line: "install freevxfs /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -57,7 +57,7 @@
         regexp: "^(#)?blacklist freevxfs(\\s|$)"
         line: "blacklist freevxfs"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.2 | PATCH | Ensure freevxfs kernel module is not available | Disable freevxfs"
       when: not system_is_container
@@ -81,7 +81,7 @@
         regexp: "^(#)?install hfs(\\s|$)"
         line: "install hfs /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -89,7 +89,7 @@
         regexp: "^(#)?blacklist hfs(\\s|$)"
         line: "blacklist hfs"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.3 | PATCH | Ensure hfs kernel module is not available | Disable hfs"
       when: not system_is_container
@@ -113,7 +113,7 @@
         regexp: "^(#)?install hfsplus(\\s|$)"
         line: "install hfsplus /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -121,7 +121,7 @@
         regexp: "^(#)?blacklist hfsplus(\\s|$)"
         line: "blacklist hfsplus"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.4 | PATCH | Ensure hfsplus kernel module is not available | Disable hfsplus"
       when: not system_is_container
@@ -145,7 +145,7 @@
         regexp: "^(#)?install jffs2(\\s|$)"
         line: "install jffs2 /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -153,7 +153,7 @@
         regexp: "^(#)?blacklist jffs2(\\s|$)"
         line: "blacklist jffs2"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.5 | PATCH | Ensure jffs2 kernel module is not available | Disable jffs2"
       when: not system_is_container
@@ -177,7 +177,7 @@
         regexp: "^(#)?install squashfs(\\s|$)"
         line: "install squashfs /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -185,7 +185,7 @@
         regexp: "^(#)?blacklist squashfs(\\s|$)"
         line: "blacklist squashfs"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.6 | PATCH | Ensure squashfs kernel module is not available | Disable squashfs"
       when: not system_is_container
@@ -209,7 +209,7 @@
         regexp: "^(#)?install udf(\\s|$)"
         line: "install udf /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -217,7 +217,7 @@
         regexp: "^(#)?blacklist udf(\\s|$)"
         line: "blacklist udf"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.7 | PATCH | Ensure udf kernel module is not available | Disable udf"
       when: not system_is_container
@@ -241,7 +241,7 @@
         regexp: "^(#)?install usb-storage(\\s|$)"
         line: "install usb-storage /bin/true"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | blacklist"
       ansible.builtin.lineinfile:
@@ -249,7 +249,7 @@
         regexp: "^(#)?blacklist usb-storage(\\s|$)"
         line: "blacklist usb-storage"
         create: true
-        mode: '0600'
+        mode: 'go-rwx'
 
     - name: "1.1.1.8 | PATCH | Ensure usb-storage kernel module is not available | Disable usb"
       when: not system_is_container
@@ -273,10 +273,10 @@
         dest: /var/fs_with_cves.sh
         owner: root
         group: root
-        mode: '0744'
+        mode: 'u+x,go-wx'
 
     - name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Run discovery script"
-      ansible.builtin.shell: /var/fs_with_cves.sh
+      ansible.builtin.command: /var/fs_with_cves.sh
       changed_when: false
       failed_when: discovered_fs_modules_loaded.rc not in [ 0, 99 ]
       register: discovered_fs_modules_loaded
@@ -286,7 +286,7 @@
       ansible.builtin.debug:
         msg: |
           "Warning!! Discovered loaded Filesystem modules that need attention. This is a manual task
-          {{ discovered_fs_modules_loaded.stdout_lines}}"
+          {{ discovered_fs_modules_loaded.stdout_lines }}"
 
     - name: "1.1.1.9 | AUDIT | Ensure unused filesystems kernel modules are not available | Capture Warning"
       when: discovered_fs_modules_loaded.stdout | length > 0