How's this?

I haven't submitted a check for the file permissions check yet, because I need to discuss the fact that EFI's grub.conf is going to be 700, not 600. A side effect of VFAT, I suppose.

- Maura Dailey

Signed-off-by: Maura Dailey <maura@eclipse.ncsc.mil>
---
 RHEL6/input/checks/file_group_owner_grub_conf.xml |   20 +++++++++++++++-----
 RHEL6/input/checks/file_user_owner_grub_conf.xml  |   20 +++++++++++++++-----
 2 files changed, 30 insertions(+), 10 deletions(-)

diff --git a/RHEL6/input/checks/file_group_owner_grub_conf.xml b/RHEL6/input/checks/file_group_owner_grub_conf.xml
index 3fc076a..6d54f69 100644
--- a/RHEL6/input/checks/file_group_owner_grub_conf.xml
+++ b/RHEL6/input/checks/file_group_owner_grub_conf.xml
@@ -1,14 +1,16 @@
 <def-group>
   <definition class="compliance" id="file_group_owner_grub_conf" version="1">
     <metadata>
-      <title>File /boot/grub/grub.conf Owned By root Group </title>
+      <title>File grub.conf Owned By root Group </title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /boot/grub/grub.conf file should be owned by the root group.</description>
+      <description>The grub.conf file should be owned by the root group. By default, this file is located at /boot/grub/grub.conf or, for EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>
+      <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
     </metadata>
-    <criteria>
+    <criteria operator="OR">
       <criterion test_ref="test_file_group_owner_grub_conf" />
+      <criterion test_ref="test_file_group_owner_efi_grub_conf" />
     </criteria>
   </definition>
 
@@ -17,9 +19,17 @@
     <unix:state state_ref="state_file_group_owner_grub_conf" />
   </unix:file_test>
 
+  <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_group_owner_efi_grub_conf" version="1">
+    <unix:object object_ref="object_file_group_owner_efi_grub_conf" />
+    <unix:state state_ref="state_file_group_owner_grub_conf" />
+  </unix:file_test>
+
   <unix:file_object comment="/boot/grub/grub.conf" id="object_file_group_owner_grub_conf" version="1">
-    <unix:path>/boot/grub</unix:path>
-    <unix:filename>grub.conf</unix:filename>
+    <unix:filepath>/boot/grub/grub.conf</unix:filepath>
+  </unix:file_object>
+
+  <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_group_owner_efi_grub_conf" version="1">
+    <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>
   </unix:file_object>
 
   <unix:file_state id="state_file_group_owner_grub_conf" version="1">
diff --git a/RHEL6/input/checks/file_user_owner_grub_conf.xml b/RHEL6/input/checks/file_user_owner_grub_conf.xml
index 53d5e2f..0a3df12 100644
--- a/RHEL6/input/checks/file_user_owner_grub_conf.xml
+++ b/RHEL6/input/checks/file_user_owner_grub_conf.xml
@@ -1,14 +1,16 @@
 <def-group>
   <definition class="compliance" id="file_user_owner_grub_conf" version="1">
     <metadata>
-      <title>File /boot/grub/grub.conf Owned By root User</title>
+      <title>File grub.conf Owned By root User</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /boot/grub/grub.conf file should be owned by the root user.</description>
+      <description>The grub.conf file should be owned by the root user. By default, this file is located at /boot/grub/grub.conf or, for EFI systems, at /boot/efi/EFI/redhat/grub.conf</description>
+      <reference source="MED" ref_id="20130830" ref_url="test_attestation" />
     </metadata>
-    <criteria>
+    <criteria operator="OR">
       <criterion test_ref="test_file_user_owner_grub_conf" />
+      <criterion test_ref="test_file_user_owner_efi_grub_conf" />
     </criteria>
   </definition>
 
@@ -17,9 +19,17 @@
     <unix:state state_ref="state_file_user_owner_grub_conf" />
   </unix:file_test>
 
+  <unix:file_test check="all" check_existence="all_exist" comment="/boot/efi/EFI/redhat/grub.conf owned by root" id="test_file_user_owner_efi_grub_conf" version="1">
+    <unix:object object_ref="object_file_user_owner_efi_grub_conf" />
+    <unix:state state_ref="state_file_user_owner_grub_conf" />
+  </unix:file_test>
+
   <unix:file_object comment="/boot/grub/grub.conf" id="object_file_user_owner_grub_conf" version="1">
-    <unix:path>/boot/grub</unix:path>
-    <unix:filename>grub.conf</unix:filename>
+    <unix:filepath>/boot/grub/grub.conf</unix:filepath>
+  </unix:file_object>
+
+  <unix:file_object comment="/boot/efi/EFI/redhat/grub.conf" id="object_file_user_owner_efi_grub_conf" version="1">
+    <unix:filepath>/boot/efi/EFI/redhat/grub.conf</unix:filepath>
   </unix:file_object>
 
   <unix:file_state id="state_file_user_owner_grub_conf" version="1">
--
1.7.1