Jan, Without the trailing / the regex will match any directory starting with /lib, /lib64, /usr/lib, or /usr/lib64. Like the spurious /usr/libexec/ file I was running into. Even if the trailing / isn't the correct fix, something needs to be changed to fix the regex.
- <unix:path operation="pattern match">^\/lib(|64)\/|^\/usr\/lib(|64)\/</unix:path> + <unix:path operation="pattern match">^\/lib(|64)$|^\/usr\/lib(|64)$</unix:path>