Signed-off-by: Maura Dailey maura@eclipse.ncsc.mil --- .../checks/accounts_root_path_dirs_no_write.xml | 57 +++++++------------- .../checks/core_dump_suid_progs_limits_conf.xml | 19 ++----- RHEL6/input/checks/core_dumps_limitsconf.xml | 23 +++----- RHEL6/input/checks/file_groupowner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_groupowner_etc_shadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_group.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_gshadow.xml | 22 +++----- RHEL6/input/checks/file_owner_etc_passwd.xml | 22 +++----- RHEL6/input/checks/file_permissions_etc_group.xml | 22 +++----- .../input/checks/file_permissions_ungroupowned.xml | 27 +++------ RHEL6/input/checks/interactive_boot_disable.xml | 18 ++---- 13 files changed, 112 insertions(+), 208 deletions(-)
diff --git a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml index 36a02cf..478ee73 100644 --- a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml +++ b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml @@ -1,60 +1,41 @@ <def-group> - <definition class="compliance" - id="accounts_root_path_dirs_no_write" version="1"> + <definition class="compliance" id="accounts_root_path_dirs_no_write" version="1"> <metadata> - <title>Write permissions are disabled for group and other in - all directories in Root's Path</title> + <title>Write permissions are disabled for group and other in all directories in Root's Path</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Check each directory in root's path and make use - it does not grant write permission to group and - other</description> + <description>Check each directory in root's path and make use it does not grant write permission to group and other</description> </metadata> - <criteria comment="Check that write permission to group and other in root's path is denied" - negate="true" operator="OR"> - <criterion comment="Check for write permission to group in root's path" - test_ref="test_2008551" /> - <criterion comment="Check for write permission to other in root's path" - test_ref="test_2008552" /> + <criteria comment="Check that write permission to group and other in root's path is denied" negate="true" operator="OR"> + <criterion comment="Check for write permission to group in root's path" test_ref="test_accounts_root_path_dirs_no_write_group" /> + <criterion comment="Check for write permission to other in root's path" test_ref="test_accounts_root_path_dirs_no_write_other" /> </criteria> </definition> - <unix:file_test check="all" check_existence="any_exist" - comment="Check that write permission to group and other in root's path is denied" - id="test_2008551" version="1"> - <unix:object object_ref="obj_200855" /> - <unix:state state_ref="state_2008551" /> + <unix:file_test check="all" check_existence="any_exist" comment="Check that write permission to group in root's path is denied" id="test_accounts_root_path_dirs_no_write_group" version="1"> + <unix:object object_ref="object_accounts_root_path_dirs_no_write" /> + <unix:state state_ref="state_accounts_root_path_dirs_no_write_group" /> </unix:file_test> - <unix:file_state comment="Group has write privilege" - id="state_2008551" version="1"> + <unix:file_state comment="Group has write privilege" id="state_accounts_root_path_dirs_no_write_group" version="1"> <unix:gwrite datatype="boolean">1</unix:gwrite> </unix:file_state> - <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - comment="root's PATH" id="obj_200855" - version="1"> - <unix:path var_ref="var_200855" /> + <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" comment="root's PATH" id="object_accounts_root_path_dirs_no_write" version="1"> + <unix:path var_ref="var_accounts_root_path_dirs_no_write" /> <unix:filename xsi:nil="true" /> </unix:file_object> - <local_variable comment="Split the PATH on the : delimiter" - datatype="string" id="var_200855" - version="1"> + <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="var_accounts_root_path_dirs_no_write" version="1"> <split delimiter=":"> - <object_component item_field="value" - object_ref="obj_20085" /> + <object_component item_field="value" object_ref="object_accounts_root_path_dirs_no_write_pathenv" /> </split> </local_variable> - <ind:environmentvariable_object id="obj_20085" - version="1"> + <ind:environmentvariable_object id="object_accounts_root_path_dirs_no_write_pathenv" version="1"> ind:namePATH</ind:name> </ind:environmentvariable_object> - <unix:file_test check="all" check_existence="any_exist" - comment="Check that write permission to group and other in root's path is denied" - id="test_2008552" version="1"> - <unix:object object_ref="obj_200855" /> - <unix:state state_ref="state_2008552" /> + <unix:file_test check="all" check_existence="any_exist" comment="Check that write permission to other in root's path is denied" id="test_accounts_root_path_dirs_no_write_other" version="1"> + <unix:object object_ref="object_accounts_root_path_dirs_no_write" /> + <unix:state state_ref="state_accounts_root_path_dirs_no_write_other" /> </unix:file_test> - <unix:file_state comment="Other has write privilege" - id="state_2008552" version="1"> + <unix:file_state comment="Other has write privilege" id="state_accounts_root_path_dirs_no_write_other" version="1"> <unix:owrite datatype="boolean">1</unix:owrite> </unix:file_state> </def-group> diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml index a2079f9..22ed337 100644 --- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml +++ b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml @@ -1,27 +1,20 @@ <def-group> - <definition class="compliance" - id="core_dump_suid_progs_limits_conf" version="1"> + <definition class="compliance" id="core_dump_suid_progs_limits_conf" version="1"> <metadata> <title>Disable Core Dumps for setuid programs</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Core dumps for setuid programs should be - disabled</description> + <description>Core dumps for setuid programs should be disabled</description> </metadata> <criteria> - <criterion comment="Are core dumps for setuid programs disabled?" - test_ref="test_20056" /> + <criterion comment="Are core dumps for setuid programs disabled?" test_ref="test_core_dump_suid_progs_limits_conf" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="none_exist" - comment="Tests the value of the ^[\s]*fs.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file" - id="test_20056" version="2"> - <ind:object object_ref="obj_20056" /> + <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the ^[\s]*fs.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file" id="test_core_dump_suid_progs_limits_conf" version="2"> + <ind:object object_ref="object_core_dump_suid_progs_limits_conf" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20056" - version="1"> + <ind:textfilecontent54_object id="object_core_dump_suid_progs_limits_conf" version="1"> ind:path/etc/security</ind:path> ind:filenamelimits.conf</ind:filename> <ind:pattern operation="pattern match">^fs.suid_dumpable\s+=\s+1$</ind:pattern> diff --git a/RHEL6/input/checks/core_dumps_limitsconf.xml b/RHEL6/input/checks/core_dumps_limitsconf.xml index cb86b30..9583361 100644 --- a/RHEL6/input/checks/core_dumps_limitsconf.xml +++ b/RHEL6/input/checks/core_dumps_limitsconf.xml @@ -1,31 +1,24 @@ <def-group> - <definition class="compliance" - id="core_dumps_limitsconf" version="1"> + <definition class="compliance" id="core_dumps_limitsconf" version="1"> <metadata> <title>Disable Core Dumps</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>Core dumps for all users should be - disabled</description> + <description>Core dumps for all users should be disabled</description> </metadata> <criteria> - <criterion comment="Are core dumps disabled" - test_ref="test_20055" /> + <criterion comment="Are core dumps disabled" test_ref="test_core_dumps_limitsconf" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - comment="Tests the value of the ^[\s]**[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" - id="test_20055" version="1"> - <ind:object object_ref="obj_20055" /> - <ind:state state_ref="state_20055" /> + <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]**[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="test_core_dumps_limitsconf" version="1"> + <ind:object object_ref="object_core_dumps_limitsconf" /> + <ind:state state_ref="state_core_dumps_limitsconf" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_state id="state_20055" - version="1"> + <ind:textfilecontent54_state id="state_core_dumps_limitsconf" version="1"> <ind:subexpression operation="equals">0</ind:subexpression> </ind:textfilecontent54_state> - <ind:textfilecontent54_object id="obj_20055" - version="1"> + <ind:textfilecontent54_object id="object_core_dumps_limitsconf" version="1"> ind:path/etc/security</ind:path> ind:filenamelimits.conf</ind:filename> <ind:pattern operation="pattern match">^[\s]**[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern> diff --git a/RHEL6/input/checks/file_groupowner_etc_group.xml b/RHEL6/input/checks/file_groupowner_etc_group.xml index eb61289..8fdc923 100644 --- a/RHEL6/input/checks/file_groupowner_etc_group.xml +++ b/RHEL6/input/checks/file_groupowner_etc_group.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_group" version="1"> + <definition class="compliance" id="file_groupowner_etc_group" version="1"> <metadata> <title>Verify group who owns 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/group file should be owned by the - appropriate group.</description> + <description>The /etc/group file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20037" /> + <criterion test_ref="test_file_groupowner_etc_group" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership" - id="test_20037" version="1"> - <unix:object object_ref="obj_20009" /> - <unix:state state_ref="state_20037" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership" id="test_file_groupowner_etc_group" version="1"> + <unix:object object_ref="object_file_groupowner_etc_group" /> + <unix:state state_ref="state_file_groupowner_etc_group" /> </unix:file_test> - <unix:file_state id="state_20037" - version="1"> + <unix:file_state id="state_file_groupowner_etc_group" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20009" version="1"> + <unix:file_object comment="/etc/group" id="object_file_groupowner_etc_group" version="1"> unix:path/etc</unix:path> unix:filenamegroup</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml index 7ee2921..139f551 100644 --- a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml +++ b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_gshadow" version="1"> + <definition class="compliance" id="file_groupowner_etc_gshadow" version="1"> <metadata> <title>Verify group who owns 'gshadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/gshadow file should be owned by the - appropriate group.</description> + <description>The /etc/gshadow file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20039" /> + <criterion test_ref="test_file_groupowner_etc_gshadow" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing gshadow ownership" - id="test_20039" version="1"> - <unix:object object_ref="obj_20013" /> - <unix:state state_ref="state_20039" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="test_file_groupowner_etc_gshadow" version="1"> + <unix:object object_ref="object_file_groupowner_etc_gshadow" /> + <unix:state state_ref="state_file_groupowner_etc_gshadow" /> </unix:file_test> - <unix:file_state id="state_20039" - version="1"> + <unix:file_state id="state_file_groupowner_etc_gshadow" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/gshadow" - id="obj_20013" version="1"> + <unix:file_object comment="/etc/gshadow" id="object_file_groupowner_etc_gshadow" version="1"> unix:path/etc</unix:path> unix:filenamegshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_passwd.xml b/RHEL6/input/checks/file_groupowner_etc_passwd.xml index d47e9bc..269bf48 100644 --- a/RHEL6/input/checks/file_groupowner_etc_passwd.xml +++ b/RHEL6/input/checks/file_groupowner_etc_passwd.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_passwd" version="1"> + <definition class="compliance" id="file_groupowner_etc_passwd" version="1"> <metadata> <title>Verify group who owns 'passwd' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/passwd file should be owned by the - appropriate group.</description> + <description>The /etc/passwd file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20041" /> + <criterion test_ref="test_file_groupowner_etc_passwd" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership of /etc/passwd" - id="test_20041" version="1"> - <unix:object object_ref="obj_20018" /> - <unix:state state_ref="state_20041" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" id="test_file_groupowner_etc_passwd" version="1"> + <unix:object object_ref="object_file_groupowner_etc_passwd" /> + <unix:state state_ref="state_file_groupowner_etc_passwd" /> </unix:file_test> - <unix:file_state id="state_20041" - version="1"> + <unix:file_state id="state_file_groupowner_etc_passwd" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/passwd" - id="obj_20018" version="1"> + <unix:file_object comment="/etc/passwd" id="object_file_groupowner_etc_passwd" version="1"> unix:path/etc</unix:path> unix:filenamepasswd</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_groupowner_etc_shadow.xml b/RHEL6/input/checks/file_groupowner_etc_shadow.xml index 4127177..21c2a10 100644 --- a/RHEL6/input/checks/file_groupowner_etc_shadow.xml +++ b/RHEL6/input/checks/file_groupowner_etc_shadow.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_groupowner_etc_shadow" version="1"> + <definition class="compliance" id="file_groupowner_etc_shadow" version="1"> <metadata> <title>Verify group who owns 'shadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/shadow file should be owned by the - appropriate group.</description> + <description>The /etc/shadow file should be owned by the appropriate group.</description> </metadata> <criteria> - <criterion test_ref="test_20035" /> + <criterion test_ref="test_groupowner_etc_shadow" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing group ownership /etc/shadow" - id="test_20035" version="1"> - <unix:object object_ref="obj_20008" /> - <unix:state state_ref="state_20035" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership /etc/shadow" id="test_groupowner_etc_shadow" version="1"> + <unix:object object_ref="object_file_groupowner_etc_shadow" /> + <unix:state state_ref="state_file_groupowner_etc_shadow" /> </unix:file_test> - <unix:file_state id="state_20035" - version="1"> + <unix:file_state id="state_file_groupowner_etc_shadow" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="/etc/shadow" - id="obj_20008" version="1"> + <unix:file_object comment="/etc/shadow" id="object_file_groupowner_etc_shadow" version="1"> unix:path/etc</unix:path> unix:filenameshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_group.xml b/RHEL6/input/checks/file_owner_etc_group.xml index de3de67..002cd57 100644 --- a/RHEL6/input/checks/file_owner_etc_group.xml +++ b/RHEL6/input/checks/file_owner_etc_group.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_group" version="1"> + <definition class="compliance" id="file_owner_etc_group" version="1"> <metadata> <title>Verify user who owns 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/group file should be owned by the - appropriate user.</description> + <description>The /etc/group file should be owned by the appropriate user.</description> </metadata> <criteria> - <criterion test_ref="test_20036" /> + <criterion test_ref="test_file_owner_etc_group" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing user ownership" - id="test_20036" version="1"> - <unix:object object_ref="obj_20036" /> - <unix:state state_ref="state_20036" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="test_file_owner_etc_group" version="1"> + <unix:object object_ref="object_file_owner_etc_group" /> + <unix:state state_ref="state_file_owner_etc_group" /> </unix:file_test> - <unix:file_state id="state_20036" - version="1"> + <unix:file_state id="state_file_owner_etc_group" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20036" version="1"> + <unix:file_object comment="/etc/group" id="object_file_owner_etc_group" version="1"> unix:path/etc</unix:path> unix:filenamegroup</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_gshadow.xml b/RHEL6/input/checks/file_owner_etc_gshadow.xml index eb02df1..b9b09f5 100644 --- a/RHEL6/input/checks/file_owner_etc_gshadow.xml +++ b/RHEL6/input/checks/file_owner_etc_gshadow.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_gshadow" version="1"> + <definition class="compliance" id="file_owner_etc_gshadow" version="1"> <metadata> <title>Verify user who owns 'gshadow' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/gshadow file should be owned by the - appropriate user.</description> + <description>The /etc/gshadow file should be owned by the appropriate user.</description> </metadata> <criteria> - <criterion test_ref="test_20038" /> + <criterion test_ref="test_file_owner_etc_gshadow" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing gshadow ownership" - id="test_20038" version="1"> - <unix:object object_ref="obj_20017" /> - <unix:state state_ref="state_20038" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="test_file_owner_etc_gshadow" version="1"> + <unix:object object_ref="object_file_owner_etc_gshadow" /> + <unix:state state_ref="state_file_owner_etc_gshadow" /> </unix:file_test> - <unix:file_state id="state_20038" - version="1"> + <unix:file_state id="state_file_owner_etc_gshadow" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/gshadow" - id="obj_20017" version="1"> + <unix:file_object comment="/etc/gshadow" id="object_file_owner_etc_gshadow" version="1"> unix:path/etc</unix:path> unix:filenamegshadow</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_owner_etc_passwd.xml b/RHEL6/input/checks/file_owner_etc_passwd.xml index 73e9899..139fb95 100644 --- a/RHEL6/input/checks/file_owner_etc_passwd.xml +++ b/RHEL6/input/checks/file_owner_etc_passwd.xml @@ -1,30 +1,24 @@ <def-group> - <definition class="compliance" - id="file_owner_etc_passwd" version="1"> + <definition class="compliance" id="file_owner_etc_passwd" version="1"> <metadata> <title>Verify user who owns 'passwd' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The /etc/passwd file should be owned by the - appropriate user.</description> + <description>The /etc/passwd file should be owned by the appropriate user.</description> </metadata> <criteria> - <criterion test_ref="test_20040" /> + <criterion test_ref="test_file_owner_etc_passwd" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing user ownership" - id="test_20040" version="1"> - <unix:object object_ref="obj_20040" /> - <unix:state state_ref="state_20040" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="test_file_owner_etc_passwd" version="1"> + <unix:object object_ref="object_file_owner_etc_passwd" /> + <unix:state state_ref="state_file_owner_etc_passwd" /> </unix:file_test> - <unix:file_state id="state_20040" - version="1"> + <unix:file_state id="state_file_owner_etc_passwd" version="1"> <unix:user_id datatype="int">0</unix:user_id> </unix:file_state> - <unix:file_object comment="/etc/passwd" - id="obj_20040" version="1"> + <unix:file_object comment="/etc/passwd" id="object_file_owner_etc_passwd" version="1"> unix:path/etc</unix:path> unix:filenamepasswd</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_permissions_etc_group.xml b/RHEL6/input/checks/file_permissions_etc_group.xml index 774c5d9..5cabfe7 100644 --- a/RHEL6/input/checks/file_permissions_etc_group.xml +++ b/RHEL6/input/checks/file_permissions_etc_group.xml @@ -1,26 +1,21 @@ <def-group> - <definition class="compliance" - id="file_permissions_etc_group" version="1"> + <definition class="compliance" id="file_permissions_etc_group" version="1"> <metadata> <title>Verify permissions on 'group' file</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>File permissions for /etc/group should be set - correctly.</description> + <description>File permissions for /etc/group should be set correctly.</description> </metadata> <criteria> - <criterion test_ref="test_20043" /> + <criterion test_ref="test_file_permissions_etc_group" /> </criteria> </definition> - <unix:file_test check="all" check_existence="all_exist" - comment="Testing /etc/group permissions" - id="test_20043" version="1"> - <unix:object object_ref="obj_20012" /> - <unix:state state_ref="state_1000645" /> + <unix:file_test check="all" check_existence="all_exist" comment="Testing /etc/group permissions" id="test_file_permissions_etc_group" version="1"> + <unix:object object_ref="object_file_permissions_etc_group" /> + <unix:state state_ref="state_file_permissions_etc_group" /> </unix:file_test> - <unix:file_state id="state_1000645" - version="1"> + <unix:file_state id="state_file_permissions_etc_group" version="1"> <unix:uread datatype="boolean">true</unix:uread> <unix:uwrite datatype="boolean">true</unix:uwrite> <unix:uexec datatype="boolean">false</unix:uexec> @@ -31,8 +26,7 @@ <unix:owrite datatype="boolean">false</unix:owrite> <unix:oexec datatype="boolean">false</unix:oexec> </unix:file_state> - <unix:file_object comment="/etc/group" - id="obj_20012" version="1"> + <unix:file_object comment="/etc/group" id="object_file_permissions_etc_group" version="1"> unix:path/etc</unix:path> unix:filenamegroup</unix:filename> </unix:file_object> diff --git a/RHEL6/input/checks/file_permissions_ungroupowned.xml b/RHEL6/input/checks/file_permissions_ungroupowned.xml index 5bc34f7..c6dcb8c 100644 --- a/RHEL6/input/checks/file_permissions_ungroupowned.xml +++ b/RHEL6/input/checks/file_permissions_ungroupowned.xml @@ -1,36 +1,27 @@ <def-group> - <definition class="compliance" - id="file_permissions_ungroupowned" version="1"> + <definition class="compliance" id="file_permissions_ungroupowned" version="1"> <metadata> <title>Find files unowned by a group</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>All files should be owned by a - group</description> + <description>All files should be owned by a group</description> </metadata> <criteria> - <criterion comment="Check all files and make sure they are owned by a group" - negate="true" - test_ref="test_20051" /> + <criterion comment="Check all files and make sure they are owned by a group" negate="true" test_ref="test_file_permissions_ungroupowned" /> </criteria> </definition> - <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" - check="all" comment="files with no group owner" - id="test_20051" version="1"> + <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" comment="files with no group owner" id="test_file_permissions_ungroupowned" version="1"> <notes> - <note>This will enumerate all files on local - partitions</note> + <note>This will enumerate all files on local partitions</note> </notes> - <unix:object object_ref="obj_20025" /> - <unix:state state_ref="state_20051" /> + <unix:object object_ref="object_file_permissions_ungroupowned" /> + <unix:state state_ref="state_file_permissions_ungroupowned" /> </unix:file_test> - <unix:file_state comment="Executables with suid set" - id="state_20051" version="1"> + <unix:file_state comment="Executables with suid set" id="state_file_permissions_ungroupowned" version="1"> <unix:group_id datatype="int">0</unix:group_id> </unix:file_state> - <unix:file_object comment="all local files" - id="obj_20025" version="1"> + <unix:file_object comment="all local files" id="object_file_permissions_ungroupowned" version="1"> <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" /> unix:path/</unix:path> <unix:filename operation="pattern match">.*</unix:filename> diff --git a/RHEL6/input/checks/interactive_boot_disable.xml b/RHEL6/input/checks/interactive_boot_disable.xml index 7f8ddd8..439baa0 100644 --- a/RHEL6/input/checks/interactive_boot_disable.xml +++ b/RHEL6/input/checks/interactive_boot_disable.xml @@ -1,26 +1,20 @@ <def-group> - <definition class="compliance" - id="interactive_boot_disable" version="1"> + <definition class="compliance" id="interactive_boot_disable" version="1"> <metadata> <title>Disable Interactive Boot</title> <affected family="unix"> <platform>Red Hat Enterprise Linux 6</platform> </affected> - <description>The ability for users to perform interactive - startups should be disabled.</description> + <description>The ability for users to perform interactive startups should be disabled.</description> </metadata> <criteria> - <criterion test_ref="test_20097" /> + <criterion test_ref="test_interactive_boot_disable" /> </criteria> </definition> - <ind:textfilecontent54_test check="all" - check_existence="all_exist" - comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file" - id="test_20097" version="1"> - <ind:object object_ref="obj_20096" /> + <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file" id="test_interactive_boot_disable" version="1"> + <ind:object object_ref="object_interactive_boot_disable" /> </ind:textfilecontent54_test> - <ind:textfilecontent54_object id="obj_20096" - version="1"> + <ind:textfilecontent54_object id="object_interactive_boot_disable" version="1"> ind:path/etc/sysconfig</ind:path> ind:filenameinit</ind:filename> <ind:pattern operation="pattern match">PROMPT[\s]*=[\s]*no\s*$</ind:pattern>