<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix"><br>
      You're encountering the same issue I did... perhaps I'm the LCD
      here... ;)<br>
      <br>
      Check out results for /usr/local/bin below. I ran the following to
      ensure everything is root before testing:<br>
      <blockquote type="cite">[shawn@SSG-RHEL6 checks]$ sudo bash<br>
        [root@SSG-RHEL6 checks]# DIRS="/bin /usr/bin /usr/local/bin
        /sbin /usr/sbin /usr/local/sbin"<br>
        [root@SSG-RHEL6 checks]# for dirPath in $DIRS; do<br>
        &gt;           find $dirPath \! -user root -exec chown root '{}'
        \;<br>
        &gt;   done<br>
        [root@SSG-RHEL6 checks]# exit<br>
        exit<br>
        [shawn@SSG-RHEL6 checks]$ ./testcheck.py
        file_ownership_binary_dirs.xml <br>
        Evaluating with OVAL tempfile :
        /tmp/file_ownership_binary_dirsU1mqUp.xml<br>
        Writing results to :
        /tmp/file_ownership_binary_dirsU1mqUp.xml-results<br>
        Definition oval:scap-security-guide.testing:def:261: true<br>
        Evaluation done.<br>
        <br>
      </blockquote>
      <br>
      <br>
      <br>
      <br>
      On 10/1/13 10:06 AM, Caleb Cooper wrote:<br>
    </div>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
Signed-off-by: Caleb Cooper <a class="moz-txt-link-rfc2396E" href="mailto:coopercd@ornl.gov">&lt;coopercd@ornl.gov&gt;</a>
---
 RHEL6/input/checks/file_ownership_binary_dirs.xml |  163 +++++++++++++++++++++
 1 files changed, 163 insertions(+), 0 deletions(-)
 create mode 100644 RHEL6/input/checks/file_ownership_binary_dirs.xml

diff --git a/RHEL6/input/checks/file_ownership_binary_dirs.xml b/RHEL6/input/checks/file_ownership_binary_dirs.xml
new file mode 100644
index 0000000..b787191
--- /dev/null
+++ b/RHEL6/input/checks/file_ownership_binary_dirs.xml
@@ -0,0 +1,163 @@
+&lt;def-group&gt;
+  &lt;definition class="compliance" id="file_ownership_binary_dirs" version="1"&gt;
+    &lt;metadata&gt;
+      &lt;title&gt;Verify that System Executables Have Root Ownership&lt;/title&gt;
+      &lt;affected family="unix"&gt;
+        &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;
+      &lt;/affected&gt;
+      &lt;description&gt;Checks that /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and objects therein, are owned by root&lt;/description&gt;
+      &lt;reference source="swells" ref_id="20130914" ref_url="test_attestation" /&gt;
+    &lt;/metadata&gt;
+    &lt;criteria operator="AND"&gt;
+      &lt;criterion test_ref="test_ownership_bin_dir" /&gt;
+      &lt;criterion test_ref="test_ownership_sbin_dir" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_bin_dir" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_sbin_dir" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_local_bin_dir" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_local_bin_dir" /&gt;
+      &lt;criterion test_ref="test_ownership_bin_files" /&gt;
+      &lt;criterion test_ref="test_ownership_sbin_files" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_bin_files" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_sbin_files" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_local_sbin_files" /&gt;
+      &lt;criterion test_ref="test_ownership_usr_local_sbin_files" /&gt;
+    &lt;/criteria&gt;
+  &lt;/definition&gt;
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/bin directories uid root" id="test_ownership_bin_dir" version="1"&gt;
+    &lt;unix:object object_ref="file_ownership_object_bin_dir" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/bin files uid root" id="test_ownership_bin_files" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_bin_files" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_object comment="/lib directories" id="file_ownership_object_bin_dir" version="1"&gt;</pre>
    </blockquote>
    <br>
    Minor note: lib/bin in comment<br>
    <br>
    <br>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/bin&lt;/unix:path&gt;
+    &lt;unix:filename xsi:nil="true" /&gt;
+    &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;
+
+  &lt;unix:file_object comment="/bin files" id="object_file_ownership_bin_files" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/bin&lt;/unix:path&gt;
+    &lt;unix:filename operation="pattern match"&gt;^.*$&lt;/unix:filename&gt;
+   &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;
+</pre>
    </blockquote>
    <br>
    <br>
    <br>
    .... testing for non-root under /bin......<br>
    [shawn@SSG-RHEL6 checks]$ sudo chown shawn:shawn /bin/awk <br>
    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
    file_ownership_binary_dirs.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/file_ownership_binary_dirs6eQhsR.xml<br>
    Writing results to :
    /tmp/file_ownership_binary_dirs6eQhsR.xml-results<br>
    Definition oval:scap-security-guide.testing:def:261: false<br>
    Evaluation done.<br>
    <br>
    <br>
    <br>
    <br>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/sbin directories uid root" id="test_ownership_sbin_dir" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_sbin_dir" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/sbin files uid root" id="test_ownership_sbin_files" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_sbin_files" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_object comment="/sbin directories" id="object_file_ownership_sbin_dir" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/sbin&lt;/unix:path&gt;
+    &lt;unix:filename xsi:nil="true" /&gt;
+    &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;
+
+  &lt;unix:file_object comment="/sbin files" id="object_file_ownership_sbin_files" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/sbin&lt;/unix:path&gt;
+    &lt;unix:filename operation="pattern match"&gt;^.*$&lt;/unix:filename&gt;
+    &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;</pre>
    </blockquote>
    <br>
    <br>
    ..... testing for non-root under /sbin .....<br>
    [shawn@SSG-RHEL6 checks]$ sudo rm /usr/local/bin/filetest <br>
    [shawn@SSG-RHEL6 checks]$ sudo chown shawn:shawn /sbin/addpart <br>
    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
    file_ownership_binary_dirs.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/file_ownership_binary_dirsu4wrQh.xml<br>
    Writing results to :
    /tmp/file_ownership_binary_dirsu4wrQh.xml-results<br>
    Definition oval:scap-security-guide.testing:def:261: false<br>
    Evaluation done.<br>
    <br>
    <br>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/bin directories uid root" id="test_ownership_usr_bin_dir" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_bin_dir" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/bin files uid root" id="test_ownership_usr_bin_files" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_bin_files" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_object comment="/usr/bin directories" id="object_file_ownership_usr_bin_dir" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/bin&lt;/unix:path&gt;
+    &lt;unix:filename xsi:nil="true" /&gt;
+        &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;
+
+  &lt;unix:file_object comment="/usr/bin files" id="object_file_ownership_usr_bin_files" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/bin&lt;/unix:path&gt;
+    &lt;unix:filename operation="pattern match"&gt;^.*$&lt;/unix:filename&gt;
+    &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;  </pre>
    </blockquote>
    <br>
    <br>
    ..... testing for non-root under /usr/bin .....<br>
    [shawn@SSG-RHEL6 checks]$ sudo chown root:root /bin/awk <br>
    [shawn@SSG-RHEL6 checks]$ sudo chown shawn:shawn /usr/bin/a2p <br>
    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
    file_ownership_binary_dirs.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/file_ownership_binary_dirs2wHH6V.xml<br>
    Writing results to :
    /tmp/file_ownership_binary_dirs2wHH6V.xml-results<br>
    Definition oval:scap-security-guide.testing:def:261: false<br>
    Evaluation done.<br>
    <br>
    <br>
    <br>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/sbin directories uid root" id="test_ownership_usr_sbin_dir" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_sbin_dir" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/sbin files uid root" id="test_ownership_usr_sbin_files" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_sbin_files" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_object comment="/usr/sbin directories" id="object_file_ownership_usr_sbin_dir" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/sbin&lt;/unix:path&gt;
+    &lt;unix:filename xsi:nil="true" /&gt;
+        &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;
+
+  &lt;unix:file_object comment="/usr/sbin files" id="object_file_ownership_usr_sbin_files" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/sbin&lt;/unix:path&gt;
+    &lt;unix:filename operation="pattern match"&gt;^.*$&lt;/unix:filename&gt;
+    &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;</pre>
    </blockquote>
    <br>
    <br>
    <br>
    ..... testing for non-root under /usr/sbin .....<br>
    [shawn@SSG-RHEL6 checks]$ sudo chown root:root /sbin/addpart <br>
    [shawn@SSG-RHEL6 checks]$ sudo chown shawn:shawn /usr/sbin/accept <br>
    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
    file_ownership_binary_dirs.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/file_ownership_binary_dirsddwRzZ.xml<br>
    Writing results to :
    /tmp/file_ownership_binary_dirsddwRzZ.xml-results<br>
    Definition oval:scap-security-guide.testing:def:261: false<br>
    Evaluation done.<br>
    <br>
    <br>
    <br>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/bin directories uid root" id="test_ownership_usr_local_bin_dir" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_local_bin_dir" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/bin files uid root" id="test_ownership_usr_local_bin_files" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_local_bin_files" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_object comment="/usr/local/bin directories" id="object_file_ownership_usr_local_bin_dir" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/local/bin&lt;/unix:path&gt;
+    &lt;unix:filename xsi:nil="true" /&gt;
+   &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;</pre>
    </blockquote>
    <br>
    <font color="#ff0000"><br>
      ..... testing for non-root under /usr/local/bin .....<br>
      [shawn@SSG-RHEL6 checks]$ sudo touch /usr/local/bin/filetest ;
      sudo chown shawn:shawn /usr/local/bin/filetest<br>
      [shawn@SSG-RHEL6 checks]$ sudo chown root:root /usr/bin/a2p <br>
      [shawn@SSG-RHEL6 checks]$ ./testcheck.py
      file_ownership_binary_dirs.xml <br>
      Evaluating with OVAL tempfile :
      /tmp/file_ownership_binary_dirsno1sSt.xml<br>
      Writing results to :
      /tmp/file_ownership_binary_dirsno1sSt.xml-results<br>
      Definition oval:scap-security-guide.testing:def:261: true<br>
      Evaluation done.<br>
      [shawn@SSG-RHEL6 checks]$ ll /usr/local/bin/filetest <br>
      -rw-r--r--. 1 shawn shawn 0 Oct  1 00:09 /usr/local/bin/filetest</font><br>
    <br>
    <br>
    <br>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
+
+  &lt;unix:file_object comment="/usr/local/bin files" id="object_file_ownership_usr_local_bin_files" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/local/bin&lt;/unix:path&gt;
+    &lt;unix:filename operation="pattern match"&gt;^.*$&lt;/unix:filename&gt;
+    &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;
+  
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/sbin directories uid root" id="test_ownership_usr_local_sbin_dir" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_local_sbin_dir" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_test  check="all" check_existence="none_exist" comment="/usr/local/sbin files uid root" id="test_ownership_usr_local_sbin_files" version="1"&gt;
+    &lt;unix:object object_ref="object_file_ownership_usr_local_sbin_files" /&gt;
+  &lt;/unix:file_test&gt;
+
+  &lt;unix:file_object comment="/usr/local/sbin directories" id="object_file_ownership_usr_local_sbin_dir" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/local/sbin&lt;/unix:path&gt;
+    &lt;unix:filename xsi:nil="true" /&gt;
+   &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;
+
+  &lt;unix:file_object comment="/usr/local/sbin files" id="object_file_ownership_usr_local_sbin_files" version="1"&gt;
+    &lt;unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="all" /&gt;
+    &lt;unix:path operation="equals"&gt;/usr/local/sbin&lt;/unix:path&gt;
+    &lt;unix:filename operation="pattern match"&gt;^.*$&lt;/unix:filename&gt;
+    &lt;filter action="include"&gt;state_owner_not_root&lt;/filter&gt;
+  &lt;/unix:file_object&gt;</pre>
    </blockquote>
    <br>
    <br>
    ..... testing for non-root under /usr/local/sbin .....<br>
    [shawn@SSG-RHEL6 checks]$ sudo chown root:root /usr/sbin/accept<br>
    [shawn@SSG-RHEL6 checks]$ sudo touch /usr/local/sbin/test ; sudo
    chown shawn:shawn /usr/local/sbin/test<br>
    [shawn@SSG-RHEL6 checks]$ ./testcheck.py
    file_ownership_binary_dirs.xml <br>
    Evaluating with OVAL tempfile :
    /tmp/file_ownership_binary_dirszY6fXL.xml<br>
    Writing results to :
    /tmp/file_ownership_binary_dirszY6fXL.xml-results<br>
    Definition oval:scap-security-guide.testing:def:261: false<br>
    Evaluation done.<br>
    <br>
    <br>
    <br>
    <blockquote
      cite="mid:1380636399-6941-2-git-send-email-coopercd@ornl.gov"
      type="cite">
      <pre wrap="">
+
+  &lt;unix:file_state id="state_owner_not_root" version="1" operator="OR"&gt;
+&lt;!--    &lt;unix:group_id datatype="int" operation="not equal"&gt;0&lt;/unix:group_id&gt; --&gt;
+    &lt;unix:user_id datatype="int" operation="not equal"&gt;0&lt;/unix:user_id&gt;
+  &lt;/unix:file_state&gt;
+&lt;/def-group&gt;
</pre>
    </blockquote>
    <br>
  </body>
</html>