From 499d1cab2e0c290869185fea3f8a22cd359edbb4 Mon Sep 17 00:00:00 2001
From: Maura Dailey <maura@eclipse.ncsc.mil>
Date: Tue, 6 Aug 2013 13:52:36 -0400
Subject: [PATCH] Small patch to replace autogenerated test, state, and object ids with human readable ones (now with 80 character line breaks)
Signed-off-by: Maura Dailey <maura@eclipse.ncsc.mil>
---
.../checks/accounts_root_path_dirs_no_write.xml | 50 +++++++++----------
.../checks/core_dump_suid_progs_limits_conf.xml | 18 ++++----
RHEL6/input/checks/core_dumps_limitsconf.xml | 23 ++++-----
RHEL6/input/checks/file_groupowner_etc_group.xml | 24 ++++-----
RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 ++++-----
RHEL6/input/checks/file_groupowner_etc_passwd.xml | 20 ++++----
RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 ++++-----
RHEL6/input/checks/file_owner_etc_group.xml | 23 ++++-----
RHEL6/input/checks/file_owner_etc_gshadow.xml | 24 ++++-----
RHEL6/input/checks/file_owner_etc_passwd.xml | 23 ++++-----
RHEL6/input/checks/file_permissions_etc_group.xml | 20 ++++----
.../input/checks/file_permissions_ungroupowned.xml | 26 +++++------
RHEL6/input/checks/interactive_boot_disable.xml | 21 ++++----
13 files changed, 145 insertions(+), 171 deletions(-)
diff --git a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
index 36a02cf..d0a20d3 100644
--- a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
+++ b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
@@ -1,60 +1,58 @@
<def-group>
- <definition class="compliance"
- id="accounts_root_path_dirs_no_write" version="1">
+ <definition class="compliance" id="accounts_root_path_dirs_no_write"
+ version="1">
<metadata>
- <title>Write permissions are disabled for group and other in
- all directories in Root's Path</title>
+ <title>Write permissions are disabled for group and other in all
+ directories in Root's Path</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>Check each directory in root's path and make use
- it does not grant write permission to group and
- other</description>
+ <description>Check each directory in root's path and make use it does not
+ grant write permission to group and other</description>
</metadata>
<criteria comment="Check that write permission to group and other in root's path is denied"
negate="true" operator="OR">
<criterion comment="Check for write permission to group in root's path"
- test_ref="test_2008551" />
+ test_ref="test_accounts_root_path_dirs_no_write_group" />
<criterion comment="Check for write permission to other in root's path"
- test_ref="test_2008552" />
+ test_ref="test_accounts_root_path_dirs_no_write_other" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="any_exist"
- comment="Check that write permission to group and other in root's path is denied"
- id="test_2008551" version="1">
- <unix:object object_ref="obj_200855" />
- <unix:state state_ref="state_2008551" />
+ comment="Check that write permission to group in root's path is denied"
+ id="test_accounts_root_path_dirs_no_write_group" version="1">
+ <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+ <unix:state state_ref="state_accounts_root_path_dirs_no_write_group" />
</unix:file_test>
<unix:file_state comment="Group has write privilege"
- id="state_2008551" version="1">
+ id="state_accounts_root_path_dirs_no_write_group" version="1">
<unix:gwrite datatype="boolean">1</unix:gwrite>
</unix:file_state>
<unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- comment="root's PATH" id="obj_200855"
+ comment="root's PATH" id="object_accounts_root_path_dirs_no_write"
version="1">
- <unix:path var_ref="var_200855" />
+ <unix:path var_ref="var_accounts_root_path_dirs_no_write" />
<unix:filename xsi:nil="true" />
</unix:file_object>
- <local_variable comment="Split the PATH on the : delimiter"
- datatype="string" id="var_200855"
- version="1">
+ <local_variable comment="Split the PATH on the : delimiter" datatype="string"
+ id="var_accounts_root_path_dirs_no_write" version="1">
<split delimiter=":">
<object_component item_field="value"
- object_ref="obj_20085" />
+ object_ref="object_accounts_root_path_dirs_no_write_pathenv" />
</split>
</local_variable>
- <ind:environmentvariable_object id="obj_20085"
+ <ind:environmentvariable_object id="object_accounts_root_path_dirs_no_write_pathenv"
version="1">
<ind:name>PATH</ind:name>
</ind:environmentvariable_object>
<unix:file_test check="all" check_existence="any_exist"
- comment="Check that write permission to group and other in root's path is denied"
- id="test_2008552" version="1">
- <unix:object object_ref="obj_200855" />
- <unix:state state_ref="state_2008552" />
+ comment="Check that write permission to other in root's path is denied"
+ id="test_accounts_root_path_dirs_no_write_other" version="1">
+ <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+ <unix:state state_ref="state_accounts_root_path_dirs_no_write_other" />
</unix:file_test>
<unix:file_state comment="Other has write privilege"
- id="state_2008552" version="1">
+ id="state_accounts_root_path_dirs_no_write_other" version="1">
<unix:owrite datatype="boolean">1</unix:owrite>
</unix:file_state>
</def-group>
diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
index a2079f9..066957a 100644
--- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
+++ b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
@@ -1,6 +1,6 @@
<def-group>
- <definition class="compliance"
- id="core_dump_suid_progs_limits_conf" version="1">
+ <definition class="compliance" id="core_dump_suid_progs_limits_conf"
+ version="1">
<metadata>
<title>Disable Core Dumps for setuid programs</title>
<affected family="unix">
@@ -11,20 +11,20 @@
</metadata>
<criteria>
<criterion comment="Are core dumps for setuid programs disabled?"
- test_ref="test_20056" />
+ test_ref="test_core_dump_suid_progs_limits_conf" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist"
+ <ind:textfilecontent54_test check="all" check_existence="none_exist"
comment="Tests the value of the ^[\s]*fs\.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file"
- id="test_20056" version="2">
- <ind:object object_ref="obj_20056" />
+ id="test_core_dump_suid_progs_limits_conf" version="2">
+ <ind:object object_ref="object_core_dump_suid_progs_limits_conf" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20056"
+ <ind:textfilecontent54_object id="object_core_dump_suid_progs_limits_conf"
version="1">
<ind:path>/etc/security</ind:path>
<ind:filename>limits.conf</ind:filename>
- <ind:pattern operation="pattern match">^fs.suid_dumpable\s+=\s+1$</ind:pattern>
+ <ind:pattern operation="pattern match">
+ ^fs.suid_dumpable\s+=\s+1$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/RHEL6/input/checks/core_dumps_limitsconf.xml b/RHEL6/input/checks/core_dumps_limitsconf.xml
index cb86b30..4107aae 100644
--- a/RHEL6/input/checks/core_dumps_limitsconf.xml
+++ b/RHEL6/input/checks/core_dumps_limitsconf.xml
@@ -1,34 +1,31 @@
<def-group>
- <definition class="compliance"
- id="core_dumps_limitsconf" version="1">
+ <definition class="compliance" id="core_dumps_limitsconf" version="1">
<metadata>
<title>Disable Core Dumps</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>Core dumps for all users should be
- disabled</description>
+ <description>Core dumps for all users should be disabled</description>
</metadata>
<criteria>
<criterion comment="Are core dumps disabled"
- test_ref="test_20055" />
+ test_ref="test_core_dumps_limitsconf" />
</criteria>
</definition>
<ind:textfilecontent54_test check="all"
comment="Tests the value of the ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file"
- id="test_20055" version="1">
- <ind:object object_ref="obj_20055" />
- <ind:state state_ref="state_20055" />
+ id="test_core_dumps_limitsconf" version="1">
+ <ind:object object_ref="object_core_dumps_limitsconf" />
+ <ind:state state_ref="state_core_dumps_limitsconf" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_20055"
- version="1">
+ <ind:textfilecontent54_state id="state_core_dumps_limitsconf" version="1">
<ind:subexpression operation="equals">0</ind:subexpression>
</ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_20055"
- version="1">
+ <ind:textfilecontent54_object id="object_core_dumps_limitsconf" version="1">
<ind:path>/etc/security</ind:path>
<ind:filename>limits.conf</ind:filename>
- <ind:pattern operation="pattern match">^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern>
+ <ind:pattern operation="pattern match">
+ ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
diff --git a/RHEL6/input/checks/file_groupowner_etc_group.xml b/RHEL6/input/checks/file_groupowner_etc_group.xml
index eb61289..67f44cb 100644
--- a/RHEL6/input/checks/file_groupowner_etc_group.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_group.xml
@@ -1,30 +1,28 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_group" version="1">
+ <definition class="compliance" id="file_groupowner_etc_group" version="1">
<metadata>
<title>Verify group who owns 'group' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/group file should be owned by the
- appropriate group.</description>
+ <description>The /etc/group file should be owned by the appropriate
+ group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20037" />
+ <criterion test_ref="test_file_groupowner_etc_group" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership"
- id="test_20037" version="1">
- <unix:object object_ref="obj_20009" />
- <unix:state state_ref="state_20037" />
- </unix:file_test>
- <unix:file_state id="state_20037"
+ comment="Testing group ownership" id="test_file_groupowner_etc_group"
version="1">
+ <unix:object object_ref="object_file_groupowner_etc_group" />
+ <unix:state state_ref="state_file_groupowner_etc_group" />
+ </unix:file_test>
+ <unix:file_state id="state_file_groupowner_etc_group" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
- <unix:file_object comment="/etc/group"
- id="obj_20009" version="1">
+ <unix:file_object comment="/etc/group" id="object_file_groupowner_etc_group"
+ version="1">
<unix:path>/etc</unix:path>
<unix:filename>group</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
index 7ee2921..833aa53 100644
--- a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
@@ -1,30 +1,28 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_gshadow" version="1">
+ <definition class="compliance" id="file_groupowner_etc_gshadow" version="1">
<metadata>
<title>Verify group who owns 'gshadow' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/gshadow file should be owned by the
- appropriate group.</description>
+ <description>The /etc/gshadow file should be owned by the appropriate
+ group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20039" />
+ <criterion test_ref="test_file_groupowner_etc_gshadow" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
- comment="Testing gshadow ownership"
- id="test_20039" version="1">
- <unix:object object_ref="obj_20013" />
- <unix:state state_ref="state_20039" />
- </unix:file_test>
- <unix:file_state id="state_20039"
+ comment="Testing gshadow ownership" id="test_file_groupowner_etc_gshadow"
version="1">
+ <unix:object object_ref="object_file_groupowner_etc_gshadow" />
+ <unix:state state_ref="state_file_groupowner_etc_gshadow" />
+ </unix:file_test>
+ <unix:file_state id="state_file_groupowner_etc_gshadow" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
<unix:file_object comment="/etc/gshadow"
- id="obj_20013" version="1">
+ id="object_file_groupowner_etc_gshadow" version="1">
<unix:path>/etc</unix:path>
<unix:filename>gshadow</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_passwd.xml b/RHEL6/input/checks/file_groupowner_etc_passwd.xml
index d47e9bc..5f79132 100644
--- a/RHEL6/input/checks/file_groupowner_etc_passwd.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_passwd.xml
@@ -1,30 +1,28 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_passwd" version="1">
+ <definition class="compliance" id="file_groupowner_etc_passwd" version="1">
<metadata>
<title>Verify group who owns 'passwd' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/passwd file should be owned by the
- appropriate group.</description>
+ <description>The /etc/passwd file should be owned by the appropriate
+ group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20041" />
+ <criterion test_ref="test_file_groupowner_etc_passwd" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
comment="Testing group ownership of /etc/passwd"
- id="test_20041" version="1">
- <unix:object object_ref="obj_20018" />
- <unix:state state_ref="state_20041" />
+ id="test_file_groupowner_etc_passwd" version="1">
+ <unix:object object_ref="object_file_groupowner_etc_passwd" />
+ <unix:state state_ref="state_file_groupowner_etc_passwd" />
</unix:file_test>
- <unix:file_state id="state_20041"
- version="1">
+ <unix:file_state id="state_file_groupowner_etc_passwd" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
<unix:file_object comment="/etc/passwd"
- id="obj_20018" version="1">
+ id="object_file_groupowner_etc_passwd" version="1">
<unix:path>/etc</unix:path>
<unix:filename>passwd</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_shadow.xml b/RHEL6/input/checks/file_groupowner_etc_shadow.xml
index 4127177..953c869 100644
--- a/RHEL6/input/checks/file_groupowner_etc_shadow.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_shadow.xml
@@ -1,30 +1,28 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_shadow" version="1">
+ <definition class="compliance" id="file_groupowner_etc_shadow" version="1">
<metadata>
<title>Verify group who owns 'shadow' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/shadow file should be owned by the
- appropriate group.</description>
+ <description>The /etc/shadow file should be owned by the appropriate
+ group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20035" />
+ <criterion test_ref="test_groupowner_etc_shadow" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership /etc/shadow"
- id="test_20035" version="1">
- <unix:object object_ref="obj_20008" />
- <unix:state state_ref="state_20035" />
- </unix:file_test>
- <unix:file_state id="state_20035"
+ comment="Testing group ownership /etc/shadow" id="test_groupowner_etc_shadow"
version="1">
+ <unix:object object_ref="object_file_groupowner_etc_shadow" />
+ <unix:state state_ref="state_file_groupowner_etc_shadow" />
+ </unix:file_test>
+ <unix:file_state id="state_file_groupowner_etc_shadow" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
<unix:file_object comment="/etc/shadow"
- id="obj_20008" version="1">
+ id="object_file_groupowner_etc_shadow" version="1">
<unix:path>/etc</unix:path>
<unix:filename>shadow</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_group.xml b/RHEL6/input/checks/file_owner_etc_group.xml
index de3de67..a74ef27 100644
--- a/RHEL6/input/checks/file_owner_etc_group.xml
+++ b/RHEL6/input/checks/file_owner_etc_group.xml
@@ -1,30 +1,27 @@
<def-group>
- <definition class="compliance"
- id="file_owner_etc_group" version="1">
+ <definition class="compliance" id="file_owner_etc_group" version="1">
<metadata>
<title>Verify user who owns 'group' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/group file should be owned by the
- appropriate user.</description>
+ <description>The /etc/group file should be owned by the appropriate
+ user.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20036" />
+ <criterion test_ref="test_file_owner_etc_group" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
- comment="Testing user ownership"
- id="test_20036" version="1">
- <unix:object object_ref="obj_20036" />
- <unix:state state_ref="state_20036" />
+ comment="Testing user ownership" id="test_file_owner_etc_group" version="1">
+ <unix:object object_ref="object_file_owner_etc_group" />
+ <unix:state state_ref="state_file_owner_etc_group" />
</unix:file_test>
- <unix:file_state id="state_20036"
- version="1">
+ <unix:file_state id="state_file_owner_etc_group" version="1">
<unix:user_id datatype="int">0</unix:user_id>
</unix:file_state>
- <unix:file_object comment="/etc/group"
- id="obj_20036" version="1">
+ <unix:file_object comment="/etc/group" id="object_file_owner_etc_group"
+ version="1">
<unix:path>/etc</unix:path>
<unix:filename>group</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_gshadow.xml b/RHEL6/input/checks/file_owner_etc_gshadow.xml
index eb02df1..a33952e 100644
--- a/RHEL6/input/checks/file_owner_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_owner_etc_gshadow.xml
@@ -1,30 +1,28 @@
<def-group>
- <definition class="compliance"
- id="file_owner_etc_gshadow" version="1">
+ <definition class="compliance" id="file_owner_etc_gshadow" version="1">
<metadata>
<title>Verify user who owns 'gshadow' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/gshadow file should be owned by the
- appropriate user.</description>
+ <description>The /etc/gshadow file should be owned by the appropriate
+ user.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20038" />
+ <criterion test_ref="test_file_owner_etc_gshadow" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
- comment="Testing gshadow ownership"
- id="test_20038" version="1">
- <unix:object object_ref="obj_20017" />
- <unix:state state_ref="state_20038" />
- </unix:file_test>
- <unix:file_state id="state_20038"
+ comment="Testing gshadow ownership" id="test_file_owner_etc_gshadow"
version="1">
+ <unix:object object_ref="object_file_owner_etc_gshadow" />
+ <unix:state state_ref="state_file_owner_etc_gshadow" />
+ </unix:file_test>
+ <unix:file_state id="state_file_owner_etc_gshadow" version="1">
<unix:user_id datatype="int">0</unix:user_id>
</unix:file_state>
- <unix:file_object comment="/etc/gshadow"
- id="obj_20017" version="1">
+ <unix:file_object comment="/etc/gshadow" id="object_file_owner_etc_gshadow"
+ version="1">
<unix:path>/etc</unix:path>
<unix:filename>gshadow</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_passwd.xml b/RHEL6/input/checks/file_owner_etc_passwd.xml
index 73e9899..5fb621d 100644
--- a/RHEL6/input/checks/file_owner_etc_passwd.xml
+++ b/RHEL6/input/checks/file_owner_etc_passwd.xml
@@ -1,30 +1,27 @@
<def-group>
- <definition class="compliance"
- id="file_owner_etc_passwd" version="1">
+ <definition class="compliance" id="file_owner_etc_passwd" version="1">
<metadata>
<title>Verify user who owns 'passwd' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/passwd file should be owned by the
- appropriate user.</description>
+ <description>The /etc/passwd file should be owned by the appropriate
+ user.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20040" />
+ <criterion test_ref="test_file_owner_etc_passwd" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
- comment="Testing user ownership"
- id="test_20040" version="1">
- <unix:object object_ref="obj_20040" />
- <unix:state state_ref="state_20040" />
+ comment="Testing user ownership" id="test_file_owner_etc_passwd" version="1">
+ <unix:object object_ref="object_file_owner_etc_passwd" />
+ <unix:state state_ref="state_file_owner_etc_passwd" />
</unix:file_test>
- <unix:file_state id="state_20040"
- version="1">
+ <unix:file_state id="state_file_owner_etc_passwd" version="1">
<unix:user_id datatype="int">0</unix:user_id>
</unix:file_state>
- <unix:file_object comment="/etc/passwd"
- id="obj_20040" version="1">
+ <unix:file_object comment="/etc/passwd" id="object_file_owner_etc_passwd"
+ version="1">
<unix:path>/etc</unix:path>
<unix:filename>passwd</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_permissions_etc_group.xml b/RHEL6/input/checks/file_permissions_etc_group.xml
index 774c5d9..c547656 100644
--- a/RHEL6/input/checks/file_permissions_etc_group.xml
+++ b/RHEL6/input/checks/file_permissions_etc_group.xml
@@ -1,6 +1,5 @@
<def-group>
- <definition class="compliance"
- id="file_permissions_etc_group" version="1">
+ <definition class="compliance" id="file_permissions_etc_group" version="1">
<metadata>
<title>Verify permissions on 'group' file</title>
<affected family="unix">
@@ -10,17 +9,16 @@
correctly.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20043" />
+ <criterion test_ref="test_file_permissions_etc_group" />
</criteria>
</definition>
<unix:file_test check="all" check_existence="all_exist"
- comment="Testing /etc/group permissions"
- id="test_20043" version="1">
- <unix:object object_ref="obj_20012" />
- <unix:state state_ref="state_1000645" />
- </unix:file_test>
- <unix:file_state id="state_1000645"
+ comment="Testing /etc/group permissions" id="test_file_permissions_etc_group"
version="1">
+ <unix:object object_ref="object_file_permissions_etc_group" />
+ <unix:state state_ref="state_file_permissions_etc_group" />
+ </unix:file_test>
+ <unix:file_state id="state_file_permissions_etc_group" version="1">
<unix:uread datatype="boolean">true</unix:uread>
<unix:uwrite datatype="boolean">true</unix:uwrite>
<unix:uexec datatype="boolean">false</unix:uexec>
@@ -31,8 +29,8 @@
<unix:owrite datatype="boolean">false</unix:owrite>
<unix:oexec datatype="boolean">false</unix:oexec>
</unix:file_state>
- <unix:file_object comment="/etc/group"
- id="obj_20012" version="1">
+ <unix:file_object comment="/etc/group" id="object_file_permissions_etc_group"
+ version="1">
<unix:path>/etc</unix:path>
<unix:filename>group</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_permissions_ungroupowned.xml b/RHEL6/input/checks/file_permissions_ungroupowned.xml
index 5bc34f7..8becd03 100644
--- a/RHEL6/input/checks/file_permissions_ungroupowned.xml
+++ b/RHEL6/input/checks/file_permissions_ungroupowned.xml
@@ -1,37 +1,35 @@
<def-group>
- <definition class="compliance"
- id="file_permissions_ungroupowned" version="1">
+ <definition class="compliance" id="file_permissions_ungroupowned"
+ version="1">
<metadata>
<title>Find files unowned by a group</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>All files should be owned by a
- group</description>
+ <description>All files should be owned by a group</description>
</metadata>
<criteria>
<criterion comment="Check all files and make sure they are owned by a group"
- negate="true"
- test_ref="test_20051" />
+ negate="true" test_ref="test_file_permissions_ungroupowned" />
</criteria>
</definition>
<unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
check="all" comment="files with no group owner"
- id="test_20051" version="1">
+ id="test_file_permissions_ungroupowned" version="1">
<notes>
- <note>This will enumerate all files on local
- partitions</note>
+ <note>This will enumerate all files on local partitions</note>
</notes>
- <unix:object object_ref="obj_20025" />
- <unix:state state_ref="state_20051" />
+ <unix:object object_ref="object_file_permissions_ungroupowned" />
+ <unix:state state_ref="state_file_permissions_ungroupowned" />
</unix:file_test>
<unix:file_state comment="Executables with suid set"
- id="state_20051" version="1">
+ id="state_file_permissions_ungroupowned" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
<unix:file_object comment="all local files"
- id="obj_20025" version="1">
- <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" />
+ id="object_file_permissions_ungroupowned" version="1">
+ <unix:behaviors recurse="symlinks and directories"
+ recurse_file_system="local" />
<unix:path>/</unix:path>
<unix:filename operation="pattern match">.*</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/interactive_boot_disable.xml b/RHEL6/input/checks/interactive_boot_disable.xml
index 7f8ddd8..0f694ea 100644
--- a/RHEL6/input/checks/interactive_boot_disable.xml
+++ b/RHEL6/input/checks/interactive_boot_disable.xml
@@ -1,29 +1,28 @@
<def-group>
- <definition class="compliance"
- id="interactive_boot_disable" version="1">
+ <definition class="compliance" id="interactive_boot_disable" version="1">
<metadata>
<title>Disable Interactive Boot</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The ability for users to perform interactive
- startups should be disabled.</description>
+ <description>The ability for users to perform interactive startups should
+ be disabled.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20097" />
+ <criterion test_ref="test_interactive_boot_disable" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
+ <ind:textfilecontent54_test check="all" check_existence="all_exist"
comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file"
- id="test_20097" version="1">
- <ind:object object_ref="obj_20096" />
+ id="test_interactive_boot_disable" version="1">
+ <ind:object object_ref="object_interactive_boot_disable" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20096"
+ <ind:textfilecontent54_object id="object_interactive_boot_disable"
version="1">
<ind:path>/etc/sysconfig</ind:path>
<ind:filename>init</ind:filename>
- <ind:pattern operation="pattern match">PROMPT[\s]*=[\s]*no\s*$</ind:pattern>
+ <ind:pattern operation="pattern match">
+ PROMPT[\s]*=[\s]*no\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
</def-group>
--
1.7.1