Lint updates

Signed-off-by: Mark Bolwell <mark.bollyuk@gmail.com>

tasks/section_3/cis_3.1.x.yml

@@ -40,7 +40,7 @@
   block:
     - name: "3.1.2 | PATCH | Ensure wireless interfaces are disabled | Check for network-manager tool"
       when: "'network-manager' in ansible_facts.packages"
-      ansible.builtin.shell: nmcli radio wifi
+      ansible.builtin.command: nmcli radio wifi
       changed_when: false
       failed_when: false
       check_mode: false
@@ -50,7 +50,7 @@
       when:
         - "'network-manager' in ansible_facts.packages"
         - "'enabled' in discovered_wifi_status.stdout"
-      ansible.builtin.shell: nmcli radio all off
+      ansible.builtin.command: nmcli radio all off
       changed_when: discovered_nmcli_radio_off.rc == 0
       register: discovered_nmcli_radio_off
 

tasks/section_3/cis_3.2.x.yml

@@ -18,6 +18,7 @@
         regexp: '^(#)?install dccp(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'u-x,go-rwx'
       loop:
         - install dccp /bin/true
         - blacklist dccp
@@ -28,7 +29,7 @@
         regexp: "^(#)?blacklist cramfs(\\s|$)"
         line: "blacklist cramfs"
         create: true
-        mode: '0600'
+        mode: 'u-x,go-rwx'
 
 - name: "3.2.2 | PATCH | Ensure tipc kernel module is not available"
   when:
@@ -48,6 +49,7 @@
         regexp: '^(#)?install tipc(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'u-x,go-rwx'
       loop:
         - install tipc /bin/true
         - blacklist tipc
@@ -58,7 +60,7 @@
         regexp: "^(#)?blacklist tipc(\\s|$)"
         line: "blacklist tipc"
         create: true
-        mode: '0600'
+        mode: 'u-x,go-rwx'
 
 - name: "3.2.3 | PATCH | Ensure rds kernel module is not available"
   when:
@@ -78,6 +80,7 @@
         regexp: '^(#)?install rds(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'u-x,go-rwx'
       loop:
         - install rds /bin/true
         - blacklist rds
@@ -88,7 +91,7 @@
         regexp: "^(#)?blacklist rds(\\s|$)"
         line: "blacklist rds"
         create: true
-        mode: '0600'
+        mode: 'u-x,go-rwx'
 
 - name: "3.2.4 | PATCH | Ensure sctp kernel module is not available"
   when:
@@ -108,6 +111,7 @@
         regexp: '^(#)?install sctp(\\s|$)'
         line: "{{ item }}"
         create: true
+        mode: 'u-x,go-rwx'
       loop:
         - install sctp /bin/true
         - blacklist sctp
@@ -118,4 +122,4 @@
         regexp: "^(#)?blacklist sctp(\\s|$)"
         line: "blacklist sctp"
         create: true
-        mode: '0600'
+        mode: 'u-x,go-rwx'