The check in ssg-rhel6-oval.xml actually checks for GID < 500, not UID < 500:
testlowgid:x:50099:100::/home/testlowgid:/bin/bash
--- orig.ssg-rhel6-oval.xml 2014-04-22 10:14:05.181639519 -0500
+++ ssg-rhel6-oval.xml 2014-04-22 10:42:40.361579812 -0500
@@ -10315,7 +10315,7 @@
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="oval:ssg:obj:1799"
version="1">
<ind:filepath>/etc/passwd</ind:filepath>
- <ind:pattern operation="pattern
match">^(?!root).*:x:[\d]*:0*([0-9]{1,2}|[1-4][0-9]{2}):[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
+ <ind:pattern operation="pattern
match">^(?!root).*:x:0*([0-9]{1,2}|[1-4][0-9]{2}):[\d]*:[^:]*:[^:]*:(?!\/sbin\/nologin|\/bin\/sync|\/sbin\/shutdown|\/sbin\/halt).*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
<ind:textfilecontent54_object id="oval:ssg:obj:1800"
version="1">
Patch verified on my test system, it no longer flags the test account.
Rick Renshaw
Show replies by thread