Signed-off-by: Maura Dailey <maura(a)eclipse.ncsc.mil>
---
.../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++-------------
.../checks/core_dump_suid_progs_limits_conf.xml | 19 ++-----
RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++-----
RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++-----
RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++-----
RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++-----
RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++-----
RHEL6/input/checks/file_owner_etc_group.xml | 22 +++-----
RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++-----
RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++-----
RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++-----
.../input/checks/file_permissions_ungroupowned.xml | 27 +++------
RHEL6/input/checks/interactive_boot_disable.xml | 18 ++----
13 files changed, 112 insertions(+), 208 deletions(-)
diff --git a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
index 36a02cf..478ee73 100644
--- a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
+++ b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
@@ -1,60 +1,41 @@
<def-group>
- <definition class="compliance"
- id="accounts_root_path_dirs_no_write" version="1">
+ <definition class="compliance"
id="accounts_root_path_dirs_no_write" version="1">
<metadata>
- <title>Write permissions are disabled for group and other in
- all directories in Root's Path</title>
+ <title>Write permissions are disabled for group and other in all directories
in Root's Path</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>Check each directory in root's path and make use
- it does not grant write permission to group and
- other</description>
+ <description>Check each directory in root's path and make use it does not
grant write permission to group and other</description>
</metadata>
- <criteria comment="Check that write permission to group and other in
root's path is denied"
- negate="true" operator="OR">
- <criterion comment="Check for write permission to group in root's
path"
- test_ref="test_2008551" />
- <criterion comment="Check for write permission to other in root's
path"
- test_ref="test_2008552" />
+ <criteria comment="Check that write permission to group and other in
root's path is denied" negate="true" operator="OR">
+ <criterion comment="Check for write permission to group in root's
path" test_ref="test_accounts_root_path_dirs_no_write_group" />
+ <criterion comment="Check for write permission to other in root's
path" test_ref="test_accounts_root_path_dirs_no_write_other" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="any_exist"
- comment="Check that write permission to group and other in root's path is
denied"
- id="test_2008551" version="1">
- <unix:object object_ref="obj_200855" />
- <unix:state state_ref="state_2008551" />
+ <unix:file_test check="all" check_existence="any_exist"
comment="Check that write permission to group in root's path is denied"
id="test_accounts_root_path_dirs_no_write_group" version="1">
+ <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+ <unix:state state_ref="state_accounts_root_path_dirs_no_write_group"
/>
</unix:file_test>
- <unix:file_state comment="Group has write privilege"
- id="state_2008551" version="1">
+ <unix:file_state comment="Group has write privilege"
id="state_accounts_root_path_dirs_no_write_group" version="1">
<unix:gwrite datatype="boolean">1</unix:gwrite>
</unix:file_state>
- <unix:file_object
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- comment="root's PATH" id="obj_200855"
- version="1">
- <unix:path var_ref="var_200855" />
+ <unix:file_object
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
comment="root's PATH" id="object_accounts_root_path_dirs_no_write"
version="1">
+ <unix:path var_ref="var_accounts_root_path_dirs_no_write" />
<unix:filename xsi:nil="true" />
</unix:file_object>
- <local_variable comment="Split the PATH on the : delimiter"
- datatype="string" id="var_200855"
- version="1">
+ <local_variable comment="Split the PATH on the : delimiter"
datatype="string" id="var_accounts_root_path_dirs_no_write"
version="1">
<split delimiter=":">
- <object_component item_field="value"
- object_ref="obj_20085" />
+ <object_component item_field="value"
object_ref="object_accounts_root_path_dirs_no_write_pathenv" />
</split>
</local_variable>
- <ind:environmentvariable_object id="obj_20085"
- version="1">
+ <ind:environmentvariable_object
id="object_accounts_root_path_dirs_no_write_pathenv" version="1">
<ind:name>PATH</ind:name>
</ind:environmentvariable_object>
- <unix:file_test check="all" check_existence="any_exist"
- comment="Check that write permission to group and other in root's path is
denied"
- id="test_2008552" version="1">
- <unix:object object_ref="obj_200855" />
- <unix:state state_ref="state_2008552" />
+ <unix:file_test check="all" check_existence="any_exist"
comment="Check that write permission to other in root's path is denied"
id="test_accounts_root_path_dirs_no_write_other" version="1">
+ <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+ <unix:state state_ref="state_accounts_root_path_dirs_no_write_other"
/>
</unix:file_test>
- <unix:file_state comment="Other has write privilege"
- id="state_2008552" version="1">
+ <unix:file_state comment="Other has write privilege"
id="state_accounts_root_path_dirs_no_write_other" version="1">
<unix:owrite datatype="boolean">1</unix:owrite>
</unix:file_state>
</def-group>
diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
index a2079f9..22ed337 100644
--- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
+++ b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
@@ -1,27 +1,20 @@
<def-group>
- <definition class="compliance"
- id="core_dump_suid_progs_limits_conf" version="1">
+ <definition class="compliance"
id="core_dump_suid_progs_limits_conf" version="1">
<metadata>
<title>Disable Core Dumps for setuid programs</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>Core dumps for setuid programs should be
- disabled</description>
+ <description>Core dumps for setuid programs should be
disabled</description>
</metadata>
<criteria>
- <criterion comment="Are core dumps for setuid programs disabled?"
- test_ref="test_20056" />
+ <criterion comment="Are core dumps for setuid programs disabled?"
test_ref="test_core_dump_suid_progs_limits_conf" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- check_existence="none_exist"
- comment="Tests the value of the ^[\s]*fs\.suid_dumpable[\s]*=([\s]*) expression in
the /etc/sysctl.conf file"
- id="test_20056" version="2">
- <ind:object object_ref="obj_20056" />
+ <ind:textfilecontent54_test check="all"
check_existence="none_exist" comment="Tests the value of the
^[\s]*fs\.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file"
id="test_core_dump_suid_progs_limits_conf" version="2">
+ <ind:object object_ref="object_core_dump_suid_progs_limits_conf" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20056"
- version="1">
+ <ind:textfilecontent54_object id="object_core_dump_suid_progs_limits_conf"
version="1">
<ind:path>/etc/security</ind:path>
<ind:filename>limits.conf</ind:filename>
<ind:pattern operation="pattern
match">^fs.suid_dumpable\s+=\s+1$</ind:pattern>
diff --git a/RHEL6/input/checks/core_dumps_limitsconf.xml
b/RHEL6/input/checks/core_dumps_limitsconf.xml
index cb86b30..9583361 100644
--- a/RHEL6/input/checks/core_dumps_limitsconf.xml
+++ b/RHEL6/input/checks/core_dumps_limitsconf.xml
@@ -1,31 +1,24 @@
<def-group>
- <definition class="compliance"
- id="core_dumps_limitsconf" version="1">
+ <definition class="compliance" id="core_dumps_limitsconf"
version="1">
<metadata>
<title>Disable Core Dumps</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>Core dumps for all users should be
- disabled</description>
+ <description>Core dumps for all users should be disabled</description>
</metadata>
<criteria>
- <criterion comment="Are core dumps disabled"
- test_ref="test_20055" />
+ <criterion comment="Are core dumps disabled"
test_ref="test_core_dumps_limitsconf" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- comment="Tests the value of the ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+) setting in
the /etc/security/limits.conf file"
- id="test_20055" version="1">
- <ind:object object_ref="obj_20055" />
- <ind:state state_ref="state_20055" />
+ <ind:textfilecontent54_test check="all" comment="Tests the value of
the ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf
file" id="test_core_dumps_limitsconf" version="1">
+ <ind:object object_ref="object_core_dumps_limitsconf" />
+ <ind:state state_ref="state_core_dumps_limitsconf" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_state id="state_20055"
- version="1">
+ <ind:textfilecontent54_state id="state_core_dumps_limitsconf"
version="1">
<ind:subexpression operation="equals">0</ind:subexpression>
</ind:textfilecontent54_state>
- <ind:textfilecontent54_object id="obj_20055"
- version="1">
+ <ind:textfilecontent54_object id="object_core_dumps_limitsconf"
version="1">
<ind:path>/etc/security</ind:path>
<ind:filename>limits.conf</ind:filename>
<ind:pattern operation="pattern
match">^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern>
diff --git a/RHEL6/input/checks/file_groupowner_etc_group.xml
b/RHEL6/input/checks/file_groupowner_etc_group.xml
index eb61289..8fdc923 100644
--- a/RHEL6/input/checks/file_groupowner_etc_group.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_group.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_group" version="1">
+ <definition class="compliance" id="file_groupowner_etc_group"
version="1">
<metadata>
<title>Verify group who owns 'group' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/group file should be owned by the
- appropriate group.</description>
+ <description>The /etc/group file should be owned by the appropriate
group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20037" />
+ <criterion test_ref="test_file_groupowner_etc_group" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership"
- id="test_20037" version="1">
- <unix:object object_ref="obj_20009" />
- <unix:state state_ref="state_20037" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing group ownership" id="test_file_groupowner_etc_group"
version="1">
+ <unix:object object_ref="object_file_groupowner_etc_group" />
+ <unix:state state_ref="state_file_groupowner_etc_group" />
</unix:file_test>
- <unix:file_state id="state_20037"
- version="1">
+ <unix:file_state id="state_file_groupowner_etc_group"
version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
- <unix:file_object comment="/etc/group"
- id="obj_20009" version="1">
+ <unix:file_object comment="/etc/group"
id="object_file_groupowner_etc_group" version="1">
<unix:path>/etc</unix:path>
<unix:filename>group</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
index 7ee2921..139f551 100644
--- a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_gshadow" version="1">
+ <definition class="compliance" id="file_groupowner_etc_gshadow"
version="1">
<metadata>
<title>Verify group who owns 'gshadow' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/gshadow file should be owned by the
- appropriate group.</description>
+ <description>The /etc/gshadow file should be owned by the appropriate
group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20039" />
+ <criterion test_ref="test_file_groupowner_etc_gshadow" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing gshadow ownership"
- id="test_20039" version="1">
- <unix:object object_ref="obj_20013" />
- <unix:state state_ref="state_20039" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing gshadow ownership"
id="test_file_groupowner_etc_gshadow" version="1">
+ <unix:object object_ref="object_file_groupowner_etc_gshadow" />
+ <unix:state state_ref="state_file_groupowner_etc_gshadow" />
</unix:file_test>
- <unix:file_state id="state_20039"
- version="1">
+ <unix:file_state id="state_file_groupowner_etc_gshadow"
version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
- <unix:file_object comment="/etc/gshadow"
- id="obj_20013" version="1">
+ <unix:file_object comment="/etc/gshadow"
id="object_file_groupowner_etc_gshadow" version="1">
<unix:path>/etc</unix:path>
<unix:filename>gshadow</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_passwd.xml
b/RHEL6/input/checks/file_groupowner_etc_passwd.xml
index d47e9bc..269bf48 100644
--- a/RHEL6/input/checks/file_groupowner_etc_passwd.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_passwd.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_passwd" version="1">
+ <definition class="compliance" id="file_groupowner_etc_passwd"
version="1">
<metadata>
<title>Verify group who owns 'passwd' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/passwd file should be owned by the
- appropriate group.</description>
+ <description>The /etc/passwd file should be owned by the appropriate
group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20041" />
+ <criterion test_ref="test_file_groupowner_etc_passwd" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership of /etc/passwd"
- id="test_20041" version="1">
- <unix:object object_ref="obj_20018" />
- <unix:state state_ref="state_20041" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing group ownership of /etc/passwd"
id="test_file_groupowner_etc_passwd" version="1">
+ <unix:object object_ref="object_file_groupowner_etc_passwd" />
+ <unix:state state_ref="state_file_groupowner_etc_passwd" />
</unix:file_test>
- <unix:file_state id="state_20041"
- version="1">
+ <unix:file_state id="state_file_groupowner_etc_passwd"
version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
- <unix:file_object comment="/etc/passwd"
- id="obj_20018" version="1">
+ <unix:file_object comment="/etc/passwd"
id="object_file_groupowner_etc_passwd" version="1">
<unix:path>/etc</unix:path>
<unix:filename>passwd</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_shadow.xml
b/RHEL6/input/checks/file_groupowner_etc_shadow.xml
index 4127177..21c2a10 100644
--- a/RHEL6/input/checks/file_groupowner_etc_shadow.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_shadow.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="file_groupowner_etc_shadow" version="1">
+ <definition class="compliance" id="file_groupowner_etc_shadow"
version="1">
<metadata>
<title>Verify group who owns 'shadow' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/shadow file should be owned by the
- appropriate group.</description>
+ <description>The /etc/shadow file should be owned by the appropriate
group.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20035" />
+ <criterion test_ref="test_groupowner_etc_shadow" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing group ownership /etc/shadow"
- id="test_20035" version="1">
- <unix:object object_ref="obj_20008" />
- <unix:state state_ref="state_20035" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing group ownership /etc/shadow"
id="test_groupowner_etc_shadow" version="1">
+ <unix:object object_ref="object_file_groupowner_etc_shadow" />
+ <unix:state state_ref="state_file_groupowner_etc_shadow" />
</unix:file_test>
- <unix:file_state id="state_20035"
- version="1">
+ <unix:file_state id="state_file_groupowner_etc_shadow"
version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
- <unix:file_object comment="/etc/shadow"
- id="obj_20008" version="1">
+ <unix:file_object comment="/etc/shadow"
id="object_file_groupowner_etc_shadow" version="1">
<unix:path>/etc</unix:path>
<unix:filename>shadow</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_group.xml
b/RHEL6/input/checks/file_owner_etc_group.xml
index de3de67..002cd57 100644
--- a/RHEL6/input/checks/file_owner_etc_group.xml
+++ b/RHEL6/input/checks/file_owner_etc_group.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="file_owner_etc_group" version="1">
+ <definition class="compliance" id="file_owner_etc_group"
version="1">
<metadata>
<title>Verify user who owns 'group' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/group file should be owned by the
- appropriate user.</description>
+ <description>The /etc/group file should be owned by the appropriate
user.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20036" />
+ <criterion test_ref="test_file_owner_etc_group" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing user ownership"
- id="test_20036" version="1">
- <unix:object object_ref="obj_20036" />
- <unix:state state_ref="state_20036" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing user ownership" id="test_file_owner_etc_group"
version="1">
+ <unix:object object_ref="object_file_owner_etc_group" />
+ <unix:state state_ref="state_file_owner_etc_group" />
</unix:file_test>
- <unix:file_state id="state_20036"
- version="1">
+ <unix:file_state id="state_file_owner_etc_group"
version="1">
<unix:user_id datatype="int">0</unix:user_id>
</unix:file_state>
- <unix:file_object comment="/etc/group"
- id="obj_20036" version="1">
+ <unix:file_object comment="/etc/group"
id="object_file_owner_etc_group" version="1">
<unix:path>/etc</unix:path>
<unix:filename>group</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_gshadow.xml
b/RHEL6/input/checks/file_owner_etc_gshadow.xml
index eb02df1..b9b09f5 100644
--- a/RHEL6/input/checks/file_owner_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_owner_etc_gshadow.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="file_owner_etc_gshadow" version="1">
+ <definition class="compliance" id="file_owner_etc_gshadow"
version="1">
<metadata>
<title>Verify user who owns 'gshadow' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/gshadow file should be owned by the
- appropriate user.</description>
+ <description>The /etc/gshadow file should be owned by the appropriate
user.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20038" />
+ <criterion test_ref="test_file_owner_etc_gshadow" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing gshadow ownership"
- id="test_20038" version="1">
- <unix:object object_ref="obj_20017" />
- <unix:state state_ref="state_20038" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing gshadow ownership" id="test_file_owner_etc_gshadow"
version="1">
+ <unix:object object_ref="object_file_owner_etc_gshadow" />
+ <unix:state state_ref="state_file_owner_etc_gshadow" />
</unix:file_test>
- <unix:file_state id="state_20038"
- version="1">
+ <unix:file_state id="state_file_owner_etc_gshadow"
version="1">
<unix:user_id datatype="int">0</unix:user_id>
</unix:file_state>
- <unix:file_object comment="/etc/gshadow"
- id="obj_20017" version="1">
+ <unix:file_object comment="/etc/gshadow"
id="object_file_owner_etc_gshadow" version="1">
<unix:path>/etc</unix:path>
<unix:filename>gshadow</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_passwd.xml
b/RHEL6/input/checks/file_owner_etc_passwd.xml
index 73e9899..139fb95 100644
--- a/RHEL6/input/checks/file_owner_etc_passwd.xml
+++ b/RHEL6/input/checks/file_owner_etc_passwd.xml
@@ -1,30 +1,24 @@
<def-group>
- <definition class="compliance"
- id="file_owner_etc_passwd" version="1">
+ <definition class="compliance" id="file_owner_etc_passwd"
version="1">
<metadata>
<title>Verify user who owns 'passwd' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The /etc/passwd file should be owned by the
- appropriate user.</description>
+ <description>The /etc/passwd file should be owned by the appropriate
user.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20040" />
+ <criterion test_ref="test_file_owner_etc_passwd" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing user ownership"
- id="test_20040" version="1">
- <unix:object object_ref="obj_20040" />
- <unix:state state_ref="state_20040" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing user ownership" id="test_file_owner_etc_passwd"
version="1">
+ <unix:object object_ref="object_file_owner_etc_passwd" />
+ <unix:state state_ref="state_file_owner_etc_passwd" />
</unix:file_test>
- <unix:file_state id="state_20040"
- version="1">
+ <unix:file_state id="state_file_owner_etc_passwd"
version="1">
<unix:user_id datatype="int">0</unix:user_id>
</unix:file_state>
- <unix:file_object comment="/etc/passwd"
- id="obj_20040" version="1">
+ <unix:file_object comment="/etc/passwd"
id="object_file_owner_etc_passwd" version="1">
<unix:path>/etc</unix:path>
<unix:filename>passwd</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_permissions_etc_group.xml
b/RHEL6/input/checks/file_permissions_etc_group.xml
index 774c5d9..5cabfe7 100644
--- a/RHEL6/input/checks/file_permissions_etc_group.xml
+++ b/RHEL6/input/checks/file_permissions_etc_group.xml
@@ -1,26 +1,21 @@
<def-group>
- <definition class="compliance"
- id="file_permissions_etc_group" version="1">
+ <definition class="compliance" id="file_permissions_etc_group"
version="1">
<metadata>
<title>Verify permissions on 'group' file</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>File permissions for /etc/group should be set
- correctly.</description>
+ <description>File permissions for /etc/group should be set
correctly.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20043" />
+ <criterion test_ref="test_file_permissions_etc_group" />
</criteria>
</definition>
- <unix:file_test check="all" check_existence="all_exist"
- comment="Testing /etc/group permissions"
- id="test_20043" version="1">
- <unix:object object_ref="obj_20012" />
- <unix:state state_ref="state_1000645" />
+ <unix:file_test check="all" check_existence="all_exist"
comment="Testing /etc/group permissions"
id="test_file_permissions_etc_group" version="1">
+ <unix:object object_ref="object_file_permissions_etc_group" />
+ <unix:state state_ref="state_file_permissions_etc_group" />
</unix:file_test>
- <unix:file_state id="state_1000645"
- version="1">
+ <unix:file_state id="state_file_permissions_etc_group"
version="1">
<unix:uread datatype="boolean">true</unix:uread>
<unix:uwrite datatype="boolean">true</unix:uwrite>
<unix:uexec datatype="boolean">false</unix:uexec>
@@ -31,8 +26,7 @@
<unix:owrite datatype="boolean">false</unix:owrite>
<unix:oexec datatype="boolean">false</unix:oexec>
</unix:file_state>
- <unix:file_object comment="/etc/group"
- id="obj_20012" version="1">
+ <unix:file_object comment="/etc/group"
id="object_file_permissions_etc_group" version="1">
<unix:path>/etc</unix:path>
<unix:filename>group</unix:filename>
</unix:file_object>
diff --git a/RHEL6/input/checks/file_permissions_ungroupowned.xml
b/RHEL6/input/checks/file_permissions_ungroupowned.xml
index 5bc34f7..c6dcb8c 100644
--- a/RHEL6/input/checks/file_permissions_ungroupowned.xml
+++ b/RHEL6/input/checks/file_permissions_ungroupowned.xml
@@ -1,36 +1,27 @@
<def-group>
- <definition class="compliance"
- id="file_permissions_ungroupowned" version="1">
+ <definition class="compliance"
id="file_permissions_ungroupowned" version="1">
<metadata>
<title>Find files unowned by a group</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>All files should be owned by a
- group</description>
+ <description>All files should be owned by a group</description>
</metadata>
<criteria>
- <criterion comment="Check all files and make sure they are owned by a
group"
- negate="true"
- test_ref="test_20051" />
+ <criterion comment="Check all files and make sure they are owned by a
group" negate="true"
test_ref="test_file_permissions_ungroupowned" />
</criteria>
</definition>
- <unix:file_test
xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix&...
- check="all" comment="files with no group owner"
- id="test_20051" version="1">
+ <unix:file_test
xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix&...
check="all" comment="files with no group owner"
id="test_file_permissions_ungroupowned" version="1">
<notes>
- <note>This will enumerate all files on local
- partitions</note>
+ <note>This will enumerate all files on local partitions</note>
</notes>
- <unix:object object_ref="obj_20025" />
- <unix:state state_ref="state_20051" />
+ <unix:object object_ref="object_file_permissions_ungroupowned" />
+ <unix:state state_ref="state_file_permissions_ungroupowned" />
</unix:file_test>
- <unix:file_state comment="Executables with suid set"
- id="state_20051" version="1">
+ <unix:file_state comment="Executables with suid set"
id="state_file_permissions_ungroupowned" version="1">
<unix:group_id datatype="int">0</unix:group_id>
</unix:file_state>
- <unix:file_object comment="all local files"
- id="obj_20025" version="1">
+ <unix:file_object comment="all local files"
id="object_file_permissions_ungroupowned" version="1">
<unix:behaviors recurse="symlinks and directories"
recurse_file_system="local" />
<unix:path>/</unix:path>
<unix:filename operation="pattern match">.*</unix:filename>
diff --git a/RHEL6/input/checks/interactive_boot_disable.xml
b/RHEL6/input/checks/interactive_boot_disable.xml
index 7f8ddd8..439baa0 100644
--- a/RHEL6/input/checks/interactive_boot_disable.xml
+++ b/RHEL6/input/checks/interactive_boot_disable.xml
@@ -1,26 +1,20 @@
<def-group>
- <definition class="compliance"
- id="interactive_boot_disable" version="1">
+ <definition class="compliance" id="interactive_boot_disable"
version="1">
<metadata>
<title>Disable Interactive Boot</title>
<affected family="unix">
<platform>Red Hat Enterprise Linux 6</platform>
</affected>
- <description>The ability for users to perform interactive
- startups should be disabled.</description>
+ <description>The ability for users to perform interactive startups should be
disabled.</description>
</metadata>
<criteria>
- <criterion test_ref="test_20097" />
+ <criterion test_ref="test_interactive_boot_disable" />
</criteria>
</definition>
- <ind:textfilecontent54_test check="all"
- check_existence="all_exist"
- comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the
/etc/sysconfig/init file"
- id="test_20097" version="1">
- <ind:object object_ref="obj_20096" />
+ <ind:textfilecontent54_test check="all"
check_existence="all_exist" comment="Tests the value of the
PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file"
id="test_interactive_boot_disable" version="1">
+ <ind:object object_ref="object_interactive_boot_disable" />
</ind:textfilecontent54_test>
- <ind:textfilecontent54_object id="obj_20096"
- version="1">
+ <ind:textfilecontent54_object id="object_interactive_boot_disable"
version="1">
<ind:path>/etc/sysconfig</ind:path>
<ind:filename>init</ind:filename>
<ind:pattern operation="pattern
match">PROMPT[\s]*=[\s]*no\s*$</ind:pattern>
--
1.7.1