On Monday, July 15, 2013 09:44:23 AM Jeffrey Blank wrote:As I recall from USGCB, we defined authorised setuid/gid files as packaged in an
> Yes, that probably makes sense.
> There's certainly room for Rules of both styles.
>
> Until we figure out how to make OVAL do that, we'll stick with your
> whitelist.
>
> Also, I added two setuid binaries to the list -- both were from abrt,
> and installed by default on my workstation. Hopefully you are okay with
> setuids from any package in RHEL.
rpm that was signed with Red Hat's key and having unchanged permissions. We
had to get specific tests into OVAL 5.10 just to make this work.Wouldn't we
just reuse the OVAL from USGCB?
-Steve