[PATCH 1/2] removal of invalid state child element in /var/log/audit ownership test

Jeffrey Blank blank at eclipse.ncsc.mil
Mon Jul 15 04:08:55 UTC 2013


Signed-off-by: Jeffrey Blank <blank at eclipse.ncsc.mil>
---
 .../input/checks/file_ownership_var_log_audit.xml  |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/RHEL6/input/checks/file_ownership_var_log_audit.xml b/RHEL6/input/checks/file_ownership_var_log_audit.xml
index a6e5c19..d597573 100644
--- a/RHEL6/input/checks/file_ownership_var_log_audit.xml
+++ b/RHEL6/input/checks/file_ownership_var_log_audit.xml
@@ -12,28 +12,32 @@
       <criterion test_ref="test_ownership_var_log_audit_directories" />
     </criteria>
   </definition>
+
   <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit directories uid root gid root" id="test_ownership_var_log_audit_directories" version="1">
     <unix:object object_ref="object_ownership_var_log_audit_directories" />
-    <unix:state state_ref="state_owner_not_root_root_var_log_audit" />
   </unix:file_test>
+
   <unix:file_test check="all" check_existence="none_exist" comment="/var/log/audit files uid root gid root" id="test_ownership_var_log_audit_files" version="1">
     <unix:object object_ref="object_ownership_var_log_audit_files" />
-    <unix:state state_ref="state_owner_not_root_root_var_log_audit" />
   </unix:file_test>
+
   <unix:file_object comment="/var/log/audit directories" id="object_ownership_var_log_audit_directories" version="1">
     <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
     <unix:path operation="equals">/var/log/audit</unix:path>
     <unix:filename xsi:nil="true" />
     <filter action="include">state_owner_not_root_root_var_log_audit</filter>
   </unix:file_object>
+
   <unix:file_object comment="/var/log/audit files" id="object_ownership_var_log_audit_files" version="1">
     <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" />
     <unix:path operation="equals">/var/log/audit</unix:path>
     <unix:filename operation="pattern match">^.*$</unix:filename>
     <filter action="include">state_owner_not_root_root_var_log_audit</filter>
   </unix:file_object>
+
   <unix:file_state id="state_owner_not_root_root_var_log_audit" version="1" operator="OR">
     <unix:group_id datatype="int" operation="not equal">0</unix:group_id>
     <unix:user_id datatype="int" operation="not equal">0</unix:user_id>
   </unix:file_state>
+
 </def-group>
-- 
1.7.1



More information about the scap-security-guide mailing list