Thanks Rui! This raises an important question about how to handle setuid/setgid programs.
Your OVAL includes a hardcoded list of setuid/setgid programs included with RHEL.
However, this could change with each update of RHEL, or with every installation of 3rd party software.
A better approach might be (as the text in XCCDF suggests) to see if each setuid or setgid program is included a part of an RPM package.
This would address the problems of:
1) installation of unpackaged software
2) admins flipping a setuid bit on a program (accidental or intentional misconfiguration)
(The threat of malicious software is not addressed by this check in any form.)
Thoughts?
Let me see if I can create OVAL to accomplish that...