Describe the bug
Remediation that requires creating a new OS user/group won't be presented to the user even though it took effect.

Preconditions
A Containerized cloudbeat using a Kind cluster.

To Reproduce

1. Verify CIS rule 1.1.12 is failing the evaluation.
2. Apply remediation:
3. SSH to host (kind cluster)
4. groupadd etcd
5. useradd -g etcd etcd
6. chown etcd:etcd /var/lib/etcd/
7. Wait a cycle for new results to be presented
8. CIS rule 1.1.12 is still failing the evaluation.

Expected behavior
CIS rule 1.1.12 is should pass as we apply the right remediation.

Investigation conclusions

1. group and user info can be found in /etc/group & /etc/passwd respectively.
2. In order to propagate this data to cloudbeat we mount those files to the elastic-agent.
3. In the case of a missing user/group we use the useradd/groupadd commands.
4. Those commands edit the mentioned files and modify their inodes.
5. When you mount an individual file into a container, what you are mounting is the inode of the file on the FS (discussion).
   As a result, the files inside the container are not synced.

Proposed solution
Mounting an entire directory will solve the issue because the directory's pointer to the inode gets updated.
Having said that, we don't want to mount the entire etc directory, therefore, we can create a new folder to mount and symlink the mentioned files.

Screenshots

useradd cmd modify /etc/passwd file inode.

Related issue:

• [BUG] cloudbeat crash once etcd folder changed group and user #118