[Feature]: Add support for pruning filesystem paths and mountpoints from OpenSCAP-backed compliance scans

What is the installation method of your PatchMon server?

Docker

What is the version of your PatchMon server?

1.4.2

Briefly describe the feature

PatchMon should provide a supported way to exclude filesystem paths or mountpoints from expensive OpenSCAP-backed file traversal rules, especially checks that use find across large backup or archival trees. ### Problem

Detailed description

Summary

PatchMon should provide a supported way to exclude filesystem paths or mountpoints from expensive OpenSCAP-backed file traversal rules, especially checks that use find across large backup or archival trees.

Problem

On a Linux host with online Timeshift backup repositories, PatchMon's hourly CIS Level 1 Server compliance scan was traversing backup-tree paths as part of the OpenSCAP rule:

• xccdf_org.ssgproject.content_rule_no_files_unowned_by_user

The affected paths included:

• /timeshift
• /run/timeshift/.../backup
• other backup-tree mountpoints

This caused avoidable disk I/O and elevated iowait, even though those trees were backup content rather than active runtime state.

Current Behavior

The effective logic behind the rule was equivalent to:

find "${partition}" -xdev -type f -nouser

There does not appear to be a supported PatchMon setting to exclude specific paths or mountpoints from this type of compliance scan.

Operational Impact

• unnecessary traversal of large backup trees
• elevated disk activity during recurring compliance runs
• degraded system responsiveness on hosts with online backup mounts
• administrators may need to patch embedded SCAP datastream content locally to stop the traversal

Current Workaround

The local workaround was to patch the embedded OpenSCAP SCE logic so backup paths are pruned before traversal, for example:

find "${partition}" \
  \( -path '/timeshift' -o -path '/timeshift/*' \
  -o -path '/run/timeshift' -o -path '/run/timeshift/*' \) -prune -o \
  -xdev -type f -nouser -print

This works, but it is brittle because package updates to the SCAP content can overwrite the local patch.

Requested Feature

Add a first-class PatchMon setting for excluding or pruning filesystem paths and mountpoints from compliance scans. Examples:

• compliance_excluded_paths
• compliance_pruned_paths
• openscap_excluded_paths
• openscap_pruned_mounts

Expected Behavior

• exclusions should be applied before traversal, not after matching
• the implementation should prune excluded paths so they are not walked at all

• exclusions should support common heavy paths such as:

  • backup trees
  • snapshot repositories
  • archival mounts
  • object-store mirrors
  • large data volumes that are not part of the live operating state

Why is this useful?

• backup and archive trees often have low security value for frequent compliance traversal
• scanning them can create disproportionate I/O cost
• local datastream patching is operationally fragile
• a supported setting would make this behavior explicit, durable, and easier to manage

Environment Example

• Linux host running PatchMon agent
• hourly OpenSCAP compliance evaluation
• online Timeshift repositories mounted locally
• elevated iowait caused in part by recurring traversal of backup trees

Desired Outcome

Administrators should be able to tell PatchMon: "do not traverse these paths during compliance scans," without having to patch vendor-provided SCAP content by hand.