<div dir="ltr">Ah cool, but that&#39;s <strong class="" style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">no_files_unowned_by_user, </strong><span class="" style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">not </span><strong class="" style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">world_writable_files_system_ownership </strong><span class="" style="color:rgb(0,0,0);font-family:sans-serif;font-size:medium;text-align:justify">(</span>CCE-26642-9) that I had the false pos on.<div>
<br></div><div>I&#39;ll try to log in in a few to update the ticket if you&#39;re busy.</div><div><br></div><div>Jeff</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Oct 4, 2013 at 8:32 PM, Shawn Wells <span dir="ltr">&lt;<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 10/4/13 8:28 PM, Shawn Wells wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 10/4/13 8:13 PM, Jeff Bachtel wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I keep getting a fail on CCE-27032-2, even after rebuilding SSG from master. The bad thing is that find / -nouser and find / -nogroup are not finding whatever files are triggering the warning.<br>
<br>
Is there a debug flag I should be using for more details from oscap to track this down?<br>
<br>
</blockquote>
<br>
The failure should be in your results file. Since you&#39;re using source:<br>
<br>
[shawn@SSG-RHEL6 checks]$ pwd<br>
/var/www/html/scap-security-<u></u>guide/RHEL6/input/checks<br>
<br>
[shawn@SSG-RHEL6 checks]$ sudo find / -xdev -type d -perm 0002 -uid +500 -print<br>
<br>
[shawn@SSG-RHEL6 checks]$ ./testcheck.py dir_perms_world_writable_<u></u>system_owned.xml<br>
Evaluating with OVAL tempfile : /tmp/dir_perms_world_writable_<u></u>system_owneddqzNLB.xml<br>
Writing results to : /tmp/dir_perms_world_writable_<u></u>system_owneddqzNLB.xml-results<br>
Definition oval:scap-security-guide.<u></u>testing:def:148: false<br>
Evaluation done.<br>
<br>
Open your results file and check what&#39;s in the system_data area. It&#39;ll indicate what files/dirs are causing the fail. On mine:<br>
<br>
[shawn@SSG-RHEL6 checks]$ grep -4 system_data /tmp/dir_perms_world_writable_<u></u>system_owneddqzNLB.xml-results<br>
          &lt;object id=&quot;oval:scap-security-guide.<u></u>testing:obj:150&quot; version=&quot;1&quot; flag=&quot;complete&quot;&gt;<br>
            &lt;reference item_ref=&quot;1104981&quot;/&gt;<br>
          &lt;/object&gt;<br>
        &lt;/collected_objects&gt;<br>
        &lt;system_data&gt;<br>
          &lt;unix-sys:file_item id=&quot;1104981&quot; status=&quot;exists&quot;&gt;<br>
            &lt;unix-sys:path&gt;/test&lt;/unix-<u></u>sys:path&gt;<br>
            &lt;unix-sys:filename&gt;&lt;/unix-sys:<u></u>filename&gt;<br>
            &lt;unix-sys:type&gt;directory&lt;/<u></u>unix-sys:type&gt;<br>
-- <br>
<br>
<br>
Clearly the find command needs updating though<br>
</blockquote></div></div>
To ensure updating the find command doesn&#39;t get forgotten about:<br>
<a href="https://fedorahosted.org/scap-security-guide/ticket/417" target="_blank">https://fedorahosted.org/scap-<u></u>security-guide/ticket/417</a><br>
<br>
.... whoever feels ambitious to take that ticket, please do so!<div class="HOEnZb"><div class="h5"><br>
______________________________<u></u>_________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
</div></div></blockquote></div><br></div>