An XCCDF Rule
/run/ovn-kubernetes/cni/ovn-cni-server.sock
$ sudo chgrp root /run/ovn-kubernetes/cni/ovn-cni-server.sock