If I fix 1.1.8 according remediation,both of 1.1.8 and 1.1.4 will PASS

- If I execute the remediation in 1.1.8 of cis-1.3.1 which is auditing `containerd.sock` ,the check 1.1.4 will also pass. Because the path of `containerd.sock` contains the `/run/containerd`

```bash
-w /run/containerd/containerd.sock -k docker
```

- As for check 1.1.4, if audit rule contains the directory `/run/containerd`,It will `PASS`
```bash
auditctl -l | grep /run/containerd
```
- But in fact, I did not audit the directory `/run/containerd`

The issue names CIS checks 1.1.4 and 1.1.8 but no source files or tests; start by locating their implementations and reproducing the auditctl output shown. Done means the checks distinguish auditing /run/containerd/containerd.sock from auditing the /run/containerd directory, with regression coverage for the reported overlap.

Written by the indexing model from the issue text.