Signed-off-by: Jeffrey Blank <blank(a)eclipse.ncsc.mil>
---
.../input/checks/file_ownership_var_log_audit.xml | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/RHEL6/input/checks/file_ownership_var_log_audit.xml
b/RHEL6/input/checks/file_ownership_var_log_audit.xml
index a6e5c19..d597573 100644
--- a/RHEL6/input/checks/file_ownership_var_log_audit.xml
+++ b/RHEL6/input/checks/file_ownership_var_log_audit.xml
@@ -12,28 +12,32 @@
<criterion test_ref="test_ownership_var_log_audit_directories" />
</criteria>
</definition>
+
<unix:file_test check="all" check_existence="none_exist"
comment="/var/log/audit directories uid root gid root"
id="test_ownership_var_log_audit_directories" version="1">
<unix:object object_ref="object_ownership_var_log_audit_directories"
/>
- <unix:state state_ref="state_owner_not_root_root_var_log_audit" />
</unix:file_test>
+
<unix:file_test check="all" check_existence="none_exist"
comment="/var/log/audit files uid root gid root"
id="test_ownership_var_log_audit_files" version="1">
<unix:object object_ref="object_ownership_var_log_audit_files" />
- <unix:state state_ref="state_owner_not_root_root_var_log_audit" />
</unix:file_test>
+
<unix:file_object comment="/var/log/audit directories"
id="object_ownership_var_log_audit_directories" version="1">
<unix:behaviors recurse="directories" recurse_direction="down"
max_depth="-1" recurse_file_system="all" />
<unix:path operation="equals">/var/log/audit</unix:path>
<unix:filename xsi:nil="true" />
<filter
action="include">state_owner_not_root_root_var_log_audit</filter>
</unix:file_object>
+
<unix:file_object comment="/var/log/audit files"
id="object_ownership_var_log_audit_files" version="1">
<unix:behaviors recurse="directories" recurse_direction="down"
max_depth="-1" recurse_file_system="all" />
<unix:path operation="equals">/var/log/audit</unix:path>
<unix:filename operation="pattern match">^.*$</unix:filename>
<filter
action="include">state_owner_not_root_root_var_log_audit</filter>
</unix:file_object>
+
<unix:file_state id="state_owner_not_root_root_var_log_audit"
version="1" operator="OR">
<unix:group_id datatype="int" operation="not
equal">0</unix:group_id>
<unix:user_id datatype="int" operation="not
equal">0</unix:user_id>
</unix:file_state>
+
</def-group>
--
1.7.1