[PATCH] Small patch to replace autogenerated test, state, and object ids with human readable ones

Maura Dailey maura at eclipse.ncsc.mil
Tue Aug 6 16:58:09 UTC 2013


Signed-off-by: Maura Dailey <maura at eclipse.ncsc.mil>
---
 .../checks/accounts_root_path_dirs_no_write.xml    |   57 +++++++-------------
 .../checks/core_dump_suid_progs_limits_conf.xml    |   19 ++-----
 RHEL6/input/checks/core_dumps_limitsconf.xml       |   23 +++-----
 RHEL6/input/checks/file_groupowner_etc_group.xml   |   22 +++-----
 RHEL6/input/checks/file_groupowner_etc_gshadow.xml |   22 +++-----
 RHEL6/input/checks/file_groupowner_etc_passwd.xml  |   22 +++-----
 RHEL6/input/checks/file_groupowner_etc_shadow.xml  |   22 +++-----
 RHEL6/input/checks/file_owner_etc_group.xml        |   22 +++-----
 RHEL6/input/checks/file_owner_etc_gshadow.xml      |   22 +++-----
 RHEL6/input/checks/file_owner_etc_passwd.xml       |   22 +++-----
 RHEL6/input/checks/file_permissions_etc_group.xml  |   22 +++-----
 .../input/checks/file_permissions_ungroupowned.xml |   27 +++------
 RHEL6/input/checks/interactive_boot_disable.xml    |   18 ++----
 13 files changed, 112 insertions(+), 208 deletions(-)

diff --git a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
index 36a02cf..478ee73 100644
--- a/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
+++ b/RHEL6/input/checks/accounts_root_path_dirs_no_write.xml
@@ -1,60 +1,41 @@
 <def-group>
-  <definition class="compliance"
-  id="accounts_root_path_dirs_no_write" version="1">
+  <definition class="compliance" id="accounts_root_path_dirs_no_write" version="1">
     <metadata>
-      <title>Write permissions are disabled for group and other in
-      all directories in Root's Path</title>
+      <title>Write permissions are disabled for group and other in all directories in Root's Path</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>Check each directory in root's path and make use
-      it does not grant write permission to group and
-      other</description>
+      <description>Check each directory in root's path and make use it does not grant write permission to group and other</description>
     </metadata>
-    <criteria comment="Check that write permission to group and other in root's path is denied"
-    negate="true" operator="OR">
-      <criterion comment="Check for write permission to group in root's path"
-      test_ref="test_2008551" />
-      <criterion comment="Check for write permission to other in root's path"
-      test_ref="test_2008552" />
+    <criteria comment="Check that write permission to group and other in root's path is denied" negate="true" operator="OR">
+      <criterion comment="Check for write permission to group in root's path" test_ref="test_accounts_root_path_dirs_no_write_group" />
+      <criterion comment="Check for write permission to other in root's path" test_ref="test_accounts_root_path_dirs_no_write_other" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="any_exist"
-  comment="Check that write permission to group and other in root's path is denied"
-  id="test_2008551" version="1">
-    <unix:object object_ref="obj_200855" />
-    <unix:state state_ref="state_2008551" />
+  <unix:file_test check="all" check_existence="any_exist" comment="Check that write permission to group in root's path is denied" id="test_accounts_root_path_dirs_no_write_group" version="1">
+    <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+    <unix:state state_ref="state_accounts_root_path_dirs_no_write_group" />
   </unix:file_test>
-  <unix:file_state comment="Group has write privilege"
-  id="state_2008551" version="1">
+  <unix:file_state comment="Group has write privilege" id="state_accounts_root_path_dirs_no_write_group" version="1">
     <unix:gwrite datatype="boolean">1</unix:gwrite>
   </unix:file_state>
-  <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-  comment="root's PATH" id="obj_200855"
-  version="1">
-    <unix:path var_ref="var_200855" />
+  <unix:file_object xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" comment="root's PATH" id="object_accounts_root_path_dirs_no_write" version="1">
+    <unix:path var_ref="var_accounts_root_path_dirs_no_write" />
     <unix:filename xsi:nil="true" />
   </unix:file_object>
-  <local_variable comment="Split the PATH on the : delimiter"
-  datatype="string" id="var_200855"
-  version="1">
+  <local_variable comment="Split the PATH on the : delimiter" datatype="string" id="var_accounts_root_path_dirs_no_write" version="1">
     <split delimiter=":">
-      <object_component item_field="value"
-      object_ref="obj_20085" />
+      <object_component item_field="value" object_ref="object_accounts_root_path_dirs_no_write_pathenv" />
     </split>
   </local_variable>
-  <ind:environmentvariable_object id="obj_20085"
-  version="1">
+  <ind:environmentvariable_object id="object_accounts_root_path_dirs_no_write_pathenv" version="1">
     <ind:name>PATH</ind:name>
   </ind:environmentvariable_object>
-  <unix:file_test check="all" check_existence="any_exist"
-  comment="Check that write permission to group and other in root's path is denied"
-  id="test_2008552" version="1">
-    <unix:object object_ref="obj_200855" />
-    <unix:state state_ref="state_2008552" />
+  <unix:file_test check="all" check_existence="any_exist" comment="Check that write permission to other in root's path is denied" id="test_accounts_root_path_dirs_no_write_other" version="1">
+    <unix:object object_ref="object_accounts_root_path_dirs_no_write" />
+    <unix:state state_ref="state_accounts_root_path_dirs_no_write_other" />
   </unix:file_test>
-  <unix:file_state comment="Other has write privilege"
-  id="state_2008552" version="1">
+  <unix:file_state comment="Other has write privilege" id="state_accounts_root_path_dirs_no_write_other" version="1">
     <unix:owrite datatype="boolean">1</unix:owrite>
   </unix:file_state>
 </def-group>
diff --git a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
index a2079f9..22ed337 100644
--- a/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
+++ b/RHEL6/input/checks/core_dump_suid_progs_limits_conf.xml
@@ -1,27 +1,20 @@
 <def-group>
-  <definition class="compliance"
-  id="core_dump_suid_progs_limits_conf" version="1">
+  <definition class="compliance" id="core_dump_suid_progs_limits_conf" version="1">
     <metadata>
       <title>Disable Core Dumps for setuid programs</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>Core dumps for setuid programs should be
-      disabled</description>
+      <description>Core dumps for setuid programs should be disabled</description>
     </metadata>
     <criteria>
-      <criterion comment="Are core dumps for setuid programs disabled?"
-      test_ref="test_20056" />
+      <criterion comment="Are core dumps for setuid programs disabled?" test_ref="test_core_dump_suid_progs_limits_conf" />
     </criteria>
   </definition>
-  <ind:textfilecontent54_test check="all"
-  check_existence="none_exist"
-  comment="Tests the value of the ^[\s]*fs\.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file"
-  id="test_20056" version="2">
-    <ind:object object_ref="obj_20056" />
+  <ind:textfilecontent54_test check="all" check_existence="none_exist" comment="Tests the value of the ^[\s]*fs\.suid_dumpable[\s]*=([\s]*) expression in the /etc/sysctl.conf file" id="test_core_dump_suid_progs_limits_conf" version="2">
+    <ind:object object_ref="object_core_dump_suid_progs_limits_conf" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_20056"
-  version="1">
+  <ind:textfilecontent54_object id="object_core_dump_suid_progs_limits_conf" version="1">
     <ind:path>/etc/security</ind:path>
     <ind:filename>limits.conf</ind:filename>
     <ind:pattern operation="pattern match">^fs.suid_dumpable\s+=\s+1$</ind:pattern>
diff --git a/RHEL6/input/checks/core_dumps_limitsconf.xml b/RHEL6/input/checks/core_dumps_limitsconf.xml
index cb86b30..9583361 100644
--- a/RHEL6/input/checks/core_dumps_limitsconf.xml
+++ b/RHEL6/input/checks/core_dumps_limitsconf.xml
@@ -1,31 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="core_dumps_limitsconf" version="1">
+  <definition class="compliance" id="core_dumps_limitsconf" version="1">
     <metadata>
       <title>Disable Core Dumps</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>Core dumps for all users should be
-      disabled</description>
+      <description>Core dumps for all users should be disabled</description>
     </metadata>
     <criteria>
-      <criterion comment="Are core dumps disabled"
-      test_ref="test_20055" />
+      <criterion comment="Are core dumps disabled" test_ref="test_core_dumps_limitsconf" />
     </criteria>
   </definition>
-  <ind:textfilecontent54_test check="all"
-  comment="Tests the value of the ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file"
-  id="test_20055" version="1">
-    <ind:object object_ref="obj_20055" />
-    <ind:state state_ref="state_20055" />
+  <ind:textfilecontent54_test check="all" comment="Tests the value of the ^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+) setting in the /etc/security/limits.conf file" id="test_core_dumps_limitsconf" version="1">
+    <ind:object object_ref="object_core_dumps_limitsconf" />
+    <ind:state state_ref="state_core_dumps_limitsconf" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_state id="state_20055"
-  version="1">
+  <ind:textfilecontent54_state id="state_core_dumps_limitsconf" version="1">
     <ind:subexpression operation="equals">0</ind:subexpression>
   </ind:textfilecontent54_state>
-  <ind:textfilecontent54_object id="obj_20055"
-  version="1">
+  <ind:textfilecontent54_object id="object_core_dumps_limitsconf" version="1">
     <ind:path>/etc/security</ind:path>
     <ind:filename>limits.conf</ind:filename>
     <ind:pattern operation="pattern match">^[\s]*\*[\s]+hard[\s]+core[\s]+([\d]+)</ind:pattern>
diff --git a/RHEL6/input/checks/file_groupowner_etc_group.xml b/RHEL6/input/checks/file_groupowner_etc_group.xml
index eb61289..8fdc923 100644
--- a/RHEL6/input/checks/file_groupowner_etc_group.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_group.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="file_groupowner_etc_group" version="1">
+  <definition class="compliance" id="file_groupowner_etc_group" version="1">
     <metadata>
       <title>Verify group who owns 'group' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /etc/group file should be owned by the
-      appropriate group.</description>
+      <description>The /etc/group file should be owned by the appropriate group.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20037" />
+      <criterion test_ref="test_file_groupowner_etc_group" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership"
-  id="test_20037" version="1">
-    <unix:object object_ref="obj_20009" />
-    <unix:state state_ref="state_20037" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership" id="test_file_groupowner_etc_group" version="1">
+    <unix:object object_ref="object_file_groupowner_etc_group" />
+    <unix:state state_ref="state_file_groupowner_etc_group" />
   </unix:file_test>
-  <unix:file_state id="state_20037"
-  version="1">
+  <unix:file_state id="state_file_groupowner_etc_group" version="1">
     <unix:group_id datatype="int">0</unix:group_id>
   </unix:file_state>
-  <unix:file_object comment="/etc/group"
-  id="obj_20009" version="1">
+  <unix:file_object comment="/etc/group" id="object_file_groupowner_etc_group" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>group</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
index 7ee2921..139f551 100644
--- a/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_gshadow.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="file_groupowner_etc_gshadow" version="1">
+  <definition class="compliance" id="file_groupowner_etc_gshadow" version="1">
     <metadata>
       <title>Verify group who owns 'gshadow' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /etc/gshadow file should be owned by the
-      appropriate group.</description>
+      <description>The /etc/gshadow file should be owned by the appropriate group.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20039" />
+      <criterion test_ref="test_file_groupowner_etc_gshadow" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing gshadow ownership"
-  id="test_20039" version="1">
-    <unix:object object_ref="obj_20013" />
-    <unix:state state_ref="state_20039" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="test_file_groupowner_etc_gshadow" version="1">
+    <unix:object object_ref="object_file_groupowner_etc_gshadow" />
+    <unix:state state_ref="state_file_groupowner_etc_gshadow" />
   </unix:file_test>
-  <unix:file_state id="state_20039"
-  version="1">
+  <unix:file_state id="state_file_groupowner_etc_gshadow" version="1">
     <unix:group_id datatype="int">0</unix:group_id>
   </unix:file_state>
-  <unix:file_object comment="/etc/gshadow"
-  id="obj_20013" version="1">
+  <unix:file_object comment="/etc/gshadow" id="object_file_groupowner_etc_gshadow" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>gshadow</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_passwd.xml b/RHEL6/input/checks/file_groupowner_etc_passwd.xml
index d47e9bc..269bf48 100644
--- a/RHEL6/input/checks/file_groupowner_etc_passwd.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_passwd.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="file_groupowner_etc_passwd" version="1">
+  <definition class="compliance" id="file_groupowner_etc_passwd" version="1">
     <metadata>
       <title>Verify group who owns 'passwd' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /etc/passwd file should be owned by the
-      appropriate group.</description>
+      <description>The /etc/passwd file should be owned by the appropriate group.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20041" />
+      <criterion test_ref="test_file_groupowner_etc_passwd" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership of /etc/passwd"
-  id="test_20041" version="1">
-    <unix:object object_ref="obj_20018" />
-    <unix:state state_ref="state_20041" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership of /etc/passwd" id="test_file_groupowner_etc_passwd" version="1">
+    <unix:object object_ref="object_file_groupowner_etc_passwd" />
+    <unix:state state_ref="state_file_groupowner_etc_passwd" />
   </unix:file_test>
-  <unix:file_state id="state_20041"
-  version="1">
+  <unix:file_state id="state_file_groupowner_etc_passwd" version="1">
     <unix:group_id datatype="int">0</unix:group_id>
   </unix:file_state>
-  <unix:file_object comment="/etc/passwd"
-  id="obj_20018" version="1">
+  <unix:file_object comment="/etc/passwd" id="object_file_groupowner_etc_passwd" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>passwd</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_groupowner_etc_shadow.xml b/RHEL6/input/checks/file_groupowner_etc_shadow.xml
index 4127177..21c2a10 100644
--- a/RHEL6/input/checks/file_groupowner_etc_shadow.xml
+++ b/RHEL6/input/checks/file_groupowner_etc_shadow.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="file_groupowner_etc_shadow" version="1">
+  <definition class="compliance" id="file_groupowner_etc_shadow" version="1">
     <metadata>
       <title>Verify group who owns 'shadow' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /etc/shadow file should be owned by the
-      appropriate group.</description>
+      <description>The /etc/shadow file should be owned by the appropriate group.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20035" />
+      <criterion test_ref="test_groupowner_etc_shadow" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing group ownership /etc/shadow"
-  id="test_20035" version="1">
-    <unix:object object_ref="obj_20008" />
-    <unix:state state_ref="state_20035" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing group ownership /etc/shadow" id="test_groupowner_etc_shadow" version="1">
+    <unix:object object_ref="object_file_groupowner_etc_shadow" />
+    <unix:state state_ref="state_file_groupowner_etc_shadow" />
   </unix:file_test>
-  <unix:file_state id="state_20035"
-  version="1">
+  <unix:file_state id="state_file_groupowner_etc_shadow" version="1">
     <unix:group_id datatype="int">0</unix:group_id>
   </unix:file_state>
-  <unix:file_object comment="/etc/shadow"
-  id="obj_20008" version="1">
+  <unix:file_object comment="/etc/shadow" id="object_file_groupowner_etc_shadow" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>shadow</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_group.xml b/RHEL6/input/checks/file_owner_etc_group.xml
index de3de67..002cd57 100644
--- a/RHEL6/input/checks/file_owner_etc_group.xml
+++ b/RHEL6/input/checks/file_owner_etc_group.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="file_owner_etc_group" version="1">
+  <definition class="compliance" id="file_owner_etc_group" version="1">
     <metadata>
       <title>Verify user who owns 'group' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /etc/group file should be owned by the
-      appropriate user.</description>
+      <description>The /etc/group file should be owned by the appropriate user.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20036" />
+      <criterion test_ref="test_file_owner_etc_group" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing user ownership"
-  id="test_20036" version="1">
-    <unix:object object_ref="obj_20036" />
-    <unix:state state_ref="state_20036" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="test_file_owner_etc_group" version="1">
+    <unix:object object_ref="object_file_owner_etc_group" />
+    <unix:state state_ref="state_file_owner_etc_group" />
   </unix:file_test>
-  <unix:file_state id="state_20036"
-  version="1">
+  <unix:file_state id="state_file_owner_etc_group" version="1">
     <unix:user_id datatype="int">0</unix:user_id>
   </unix:file_state>
-  <unix:file_object comment="/etc/group"
-  id="obj_20036" version="1">
+  <unix:file_object comment="/etc/group" id="object_file_owner_etc_group" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>group</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_gshadow.xml b/RHEL6/input/checks/file_owner_etc_gshadow.xml
index eb02df1..b9b09f5 100644
--- a/RHEL6/input/checks/file_owner_etc_gshadow.xml
+++ b/RHEL6/input/checks/file_owner_etc_gshadow.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="file_owner_etc_gshadow" version="1">
+  <definition class="compliance" id="file_owner_etc_gshadow" version="1">
     <metadata>
       <title>Verify user who owns 'gshadow' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /etc/gshadow file should be owned by the
-      appropriate user.</description>
+      <description>The /etc/gshadow file should be owned by the appropriate user.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20038" />
+      <criterion test_ref="test_file_owner_etc_gshadow" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing gshadow ownership"
-  id="test_20038" version="1">
-    <unix:object object_ref="obj_20017" />
-    <unix:state state_ref="state_20038" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing gshadow ownership" id="test_file_owner_etc_gshadow" version="1">
+    <unix:object object_ref="object_file_owner_etc_gshadow" />
+    <unix:state state_ref="state_file_owner_etc_gshadow" />
   </unix:file_test>
-  <unix:file_state id="state_20038"
-  version="1">
+  <unix:file_state id="state_file_owner_etc_gshadow" version="1">
     <unix:user_id datatype="int">0</unix:user_id>
   </unix:file_state>
-  <unix:file_object comment="/etc/gshadow"
-  id="obj_20017" version="1">
+  <unix:file_object comment="/etc/gshadow" id="object_file_owner_etc_gshadow" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>gshadow</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_owner_etc_passwd.xml b/RHEL6/input/checks/file_owner_etc_passwd.xml
index 73e9899..139fb95 100644
--- a/RHEL6/input/checks/file_owner_etc_passwd.xml
+++ b/RHEL6/input/checks/file_owner_etc_passwd.xml
@@ -1,30 +1,24 @@
 <def-group>
-  <definition class="compliance"
-  id="file_owner_etc_passwd" version="1">
+  <definition class="compliance" id="file_owner_etc_passwd" version="1">
     <metadata>
       <title>Verify user who owns 'passwd' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The /etc/passwd file should be owned by the
-      appropriate user.</description>
+      <description>The /etc/passwd file should be owned by the appropriate user.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20040" />
+      <criterion test_ref="test_file_owner_etc_passwd" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing user ownership"
-  id="test_20040" version="1">
-    <unix:object object_ref="obj_20040" />
-    <unix:state state_ref="state_20040" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing user ownership" id="test_file_owner_etc_passwd" version="1">
+    <unix:object object_ref="object_file_owner_etc_passwd" />
+    <unix:state state_ref="state_file_owner_etc_passwd" />
   </unix:file_test>
-  <unix:file_state id="state_20040"
-  version="1">
+  <unix:file_state id="state_file_owner_etc_passwd" version="1">
     <unix:user_id datatype="int">0</unix:user_id>
   </unix:file_state>
-  <unix:file_object comment="/etc/passwd"
-  id="obj_20040" version="1">
+  <unix:file_object comment="/etc/passwd" id="object_file_owner_etc_passwd" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>passwd</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_permissions_etc_group.xml b/RHEL6/input/checks/file_permissions_etc_group.xml
index 774c5d9..5cabfe7 100644
--- a/RHEL6/input/checks/file_permissions_etc_group.xml
+++ b/RHEL6/input/checks/file_permissions_etc_group.xml
@@ -1,26 +1,21 @@
 <def-group>
-  <definition class="compliance"
-  id="file_permissions_etc_group" version="1">
+  <definition class="compliance" id="file_permissions_etc_group" version="1">
     <metadata>
       <title>Verify permissions on 'group' file</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>File permissions for /etc/group should be set
-      correctly.</description>
+      <description>File permissions for /etc/group should be set correctly.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20043" />
+      <criterion test_ref="test_file_permissions_etc_group" />
     </criteria>
   </definition>
-  <unix:file_test check="all" check_existence="all_exist"
-  comment="Testing /etc/group permissions"
-  id="test_20043" version="1">
-    <unix:object object_ref="obj_20012" />
-    <unix:state state_ref="state_1000645" />
+  <unix:file_test check="all" check_existence="all_exist" comment="Testing /etc/group permissions" id="test_file_permissions_etc_group" version="1">
+    <unix:object object_ref="object_file_permissions_etc_group" />
+    <unix:state state_ref="state_file_permissions_etc_group" />
   </unix:file_test>
-  <unix:file_state id="state_1000645"
-  version="1">
+  <unix:file_state id="state_file_permissions_etc_group" version="1">
     <unix:uread datatype="boolean">true</unix:uread>
     <unix:uwrite datatype="boolean">true</unix:uwrite>
     <unix:uexec datatype="boolean">false</unix:uexec>
@@ -31,8 +26,7 @@
     <unix:owrite datatype="boolean">false</unix:owrite>
     <unix:oexec datatype="boolean">false</unix:oexec>
   </unix:file_state>
-  <unix:file_object comment="/etc/group"
-  id="obj_20012" version="1">
+  <unix:file_object comment="/etc/group" id="object_file_permissions_etc_group" version="1">
     <unix:path>/etc</unix:path>
     <unix:filename>group</unix:filename>
   </unix:file_object>
diff --git a/RHEL6/input/checks/file_permissions_ungroupowned.xml b/RHEL6/input/checks/file_permissions_ungroupowned.xml
index 5bc34f7..c6dcb8c 100644
--- a/RHEL6/input/checks/file_permissions_ungroupowned.xml
+++ b/RHEL6/input/checks/file_permissions_ungroupowned.xml
@@ -1,36 +1,27 @@
 <def-group>
-  <definition class="compliance"
-  id="file_permissions_ungroupowned" version="1">
+  <definition class="compliance" id="file_permissions_ungroupowned" version="1">
     <metadata>
       <title>Find files unowned by a group</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>All files should be owned by a
-      group</description>
+      <description>All files should be owned by a group</description>
     </metadata>
     <criteria>
-      <criterion comment="Check all files and make sure they are owned by a group"
-      negate="true"
-      test_ref="test_20051" />
+      <criterion comment="Check all files and make sure they are owned by a group" negate="true" test_ref="test_file_permissions_ungroupowned" />
     </criteria>
   </definition>
-  <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"
-  check="all" comment="files with no group owner"
-  id="test_20051" version="1">
+  <unix:file_test xmlns:unix="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix" check="all" comment="files with no group owner" id="test_file_permissions_ungroupowned" version="1">
     <notes>
-      <note>This will enumerate all files on local
-      partitions</note>
+      <note>This will enumerate all files on local partitions</note>
     </notes>
-    <unix:object object_ref="obj_20025" />
-    <unix:state state_ref="state_20051" />
+    <unix:object object_ref="object_file_permissions_ungroupowned" />
+    <unix:state state_ref="state_file_permissions_ungroupowned" />
   </unix:file_test>
-  <unix:file_state comment="Executables with suid set"
-  id="state_20051" version="1">
+  <unix:file_state comment="Executables with suid set" id="state_file_permissions_ungroupowned" version="1">
     <unix:group_id datatype="int">0</unix:group_id>
   </unix:file_state>
-  <unix:file_object comment="all local files"
-  id="obj_20025" version="1">
+  <unix:file_object comment="all local files" id="object_file_permissions_ungroupowned" version="1">
     <unix:behaviors recurse="symlinks and directories" recurse_file_system="local" />
     <unix:path>/</unix:path>
     <unix:filename operation="pattern match">.*</unix:filename>
diff --git a/RHEL6/input/checks/interactive_boot_disable.xml b/RHEL6/input/checks/interactive_boot_disable.xml
index 7f8ddd8..439baa0 100644
--- a/RHEL6/input/checks/interactive_boot_disable.xml
+++ b/RHEL6/input/checks/interactive_boot_disable.xml
@@ -1,26 +1,20 @@
 <def-group>
-  <definition class="compliance"
-  id="interactive_boot_disable" version="1">
+  <definition class="compliance" id="interactive_boot_disable" version="1">
     <metadata>
       <title>Disable Interactive Boot</title>
       <affected family="unix">
         <platform>Red Hat Enterprise Linux 6</platform>
       </affected>
-      <description>The ability for users to perform interactive
-      startups should be disabled.</description>
+      <description>The ability for users to perform interactive startups should be disabled.</description>
     </metadata>
     <criteria>
-      <criterion test_ref="test_20097" />
+      <criterion test_ref="test_interactive_boot_disable" />
     </criteria>
   </definition>
-  <ind:textfilecontent54_test check="all"
-  check_existence="all_exist"
-  comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file"
-  id="test_20097" version="1">
-    <ind:object object_ref="obj_20096" />
+  <ind:textfilecontent54_test check="all" check_existence="all_exist" comment="Tests the value of the PROMPT[\s]*=[\s]*([^#]*) expression in the /etc/sysconfig/init file" id="test_interactive_boot_disable" version="1">
+    <ind:object object_ref="object_interactive_boot_disable" />
   </ind:textfilecontent54_test>
-  <ind:textfilecontent54_object id="obj_20096"
-  version="1">
+  <ind:textfilecontent54_object id="object_interactive_boot_disable" version="1">
     <ind:path>/etc/sysconfig</ind:path>
     <ind:filename>init</ind:filename>
     <ind:pattern operation="pattern match">PROMPT[\s]*=[\s]*no\s*$</ind:pattern>
-- 
1.7.1



More information about the scap-security-guide mailing list