Indeed -- I remember the thread on the OVAL list (and it even came up in my Googling).  
But the content at http://usgcb.nist.gov/usgcb/rhel/download_rhel5.html is still using whitelists.  

If such a test were available somewhere, we'd be most interested. 




On Mon, Jul 15, 2013 at 1:40 PM, Steve Grubb <sgrubb@redhat.com> wrote:
On Monday, July 15, 2013 09:44:23 AM Jeffrey Blank wrote:
> Yes, that probably makes sense.
> There's certainly room for Rules of both styles.
>
> Until we figure out how to make OVAL do that, we'll stick with your
> whitelist.
>
> Also, I added two setuid binaries to the list -- both were from abrt,
> and installed by default on my workstation.  Hopefully you are okay with
> setuids from any package in RHEL.

As I recall from USGCB, we defined authorised setuid/gid files as packaged in an
rpm that was signed with Red Hat's key and having unchanged permissions. We
had to get specific tests into OVAL 5.10 just to make this work.Wouldn't we
just reuse the OVAL from USGCB?

-Steve