<html>
  <head>
    <meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 12/18/13, 10:45 AM, Rodney L. Mercer
      wrote:<br>
    </div>
    <blockquote cite="mid:1387381521.2799.1408.camel@osc145" type="cite">
      <div class="moz-text-plain" wrap="true" graphical-quote="true"
        style="font-family: -moz-fixed; font-size: 12px;"
        lang="x-unicode">
        <pre wrap="">Based on comments and recommendations from the following thread, I've
submitted a patch to fix CCE-27032-2 no_files_unowned_by_user.xml
<a moz-do-not-send="true" class="moz-txt-link-freetext" href="https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/003627.html">https://lists.fedorahosted.org/pipermail/scap-security-guide/2013-July/003627.html</a>

This only checks /etc/passwd and not any other authorization databases.


8&lt;====================
&gt;From ab80797697bdf00c5e05caf150124df67e0a9a51 Mon Sep 17 00:00:00 2001
From: Rodney Mercer <a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="mailto:rmercer@harris.com">&lt;rmercer@harris.com&gt;</a>
Date: Wed, 18 Dec 2013 15:01:25 +0000
Subject: [PATCH] Modified no_files_unowned_by_user.xml
 modified completely broken no_files_unowned_by_user.xml to properly
check all files on the system to make sure that they are owned by a user
that resides in /etc/passwd.

---
 RHEL6/input/checks/no_files_unowned_by_user.xml |   51
++++++++++++----------
 1 files changed, 28 insertions(+), 23 deletions(-)

diff --git a/RHEL6/input/checks/no_files_unowned_by_user.xml
b/RHEL6/input/checks/no_files_unowned_by_user.xml
index a73183a..f3f1276 100644
--- a/RHEL6/input/checks/no_files_unowned_by_user.xml
+++ b/RHEL6/input/checks/no_files_unowned_by_user.xml
@@ -1,38 +1,43 @@
 &lt;def-group&gt;
-  &lt;definition class="compliance"
-  id="no_files_unowned_by_user" version="1"&gt;
+  &lt;definition class="compliance" id="no_files_unowned_by_user"
version="1"&gt;
     &lt;metadata&gt;
       &lt;title&gt;Find files unowned by a user&lt;/title&gt;
       &lt;affected family="unix"&gt;
         &lt;platform&gt;Red Hat Enterprise Linux 6&lt;/platform&gt;
       &lt;/affected&gt;
-      &lt;description&gt;All files should be owned by a
-      user&lt;/description&gt;
+      &lt;description&gt;All files should be owned by a user&lt;/description&gt;
+      &lt;reference source="rmercer" ref_id="20131218"
ref_url="test_attestation" /&gt;
     &lt;/metadata&gt;
     &lt;criteria&gt;
-      &lt;criterion comment="Check all files and make sure they are owned
by a user"
-      negate="true"
-      test_ref="test_20050" /&gt;
+      &lt;criterion comment="Check all files and make sure they are owned
by a user" test_ref="no_files_unowned_by_user_test" /&gt;
     &lt;/criteria&gt;
   &lt;/definition&gt;
-  &lt;unix:file_test
xmlns:unix=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"</a>
-  check="all" comment="files with no user owner"
-  id="test_20050" version="1"&gt;
-    &lt;notes&gt;
-      &lt;note&gt;This will enumerate all files on local
-      partitions&lt;/note&gt;
-    &lt;/notes&gt;
-    &lt;unix:object object_ref="obj_20022" /&gt;
-    &lt;unix:state state_ref="state_20050" /&gt;
-  &lt;/unix:file_test&gt;
-  &lt;unix:file_state comment="Executables with suid set"
-  id="state_20050" version="1"&gt;
-    &lt;unix:user_id datatype="int"&gt;0&lt;/unix:user_id&gt;
+
+  &lt;unix:file_state id="file_permissions_unowned_userid_list_match"
version="1"&gt;
+    &lt;unix:user_id var_check="at least one"
var_ref="file_permissions_unowned_userid_list" datatype="int" /&gt;
   &lt;/unix:file_state&gt;
-  &lt;unix:file_object comment="all local files"
-  id="obj_20022" version="1"&gt;
-    &lt;unix:behaviors recurse="symlinks and directories"
recurse_file_system="local" /&gt;
+
+  &lt;local_variable id="file_permissions_unowned_userid_list"
comment="List of valid user ids" datatype="int" version="1"&gt;
+    &lt;object_component item_field="subexpression"
object_ref="file_permissions_unowned_userid_list_object" /&gt;
+  &lt;/local_variable&gt;
+
+  &lt;ind:textfilecontent54_object
id="file_permissions_unowned_userid_list_object" version="1"&gt;
+    &lt;ind:filepath&gt;/etc/passwd&lt;/ind:filepath&gt;
+    &lt;ind:pattern operation="pattern
match"&gt;^[^:]+:[^:]+:([\d]+):[\d]+:[^:]*:[^:]+:[^:]*$&lt;/ind:pattern&gt;
+    &lt;ind:instance operation="greater than or equal"
datatype="int"&gt;1&lt;/ind:instance&gt;
+  &lt;/ind:textfilecontent54_object&gt;
+
+  &lt;unix:file_object comment="all local files"
id="file_permissions_unowned_object" version="1"&gt;
+    &lt;unix:behaviors recurse="symlinks and directories"
recurse_direction="down" recurse_file_system="local" /&gt;
     &lt;unix:path&gt;/&lt;/unix:path&gt;
     &lt;unix:filename operation="pattern match"&gt;.*&lt;/unix:filename&gt;
+    &lt;filter
action="exclude"&gt;file_permissions_unowned_userid_list_match&lt;/filter&gt;
   &lt;/unix:file_object&gt;
+  
+  &lt;unix:file_test
xmlns:unix=<a moz-do-not-send="true" class="moz-txt-link-rfc2396E" href="http://oval.mitre.org/XMLSchema/oval-definitions-5#unix">"http://oval.mitre.org/XMLSchema/oval-definitions-5#unix"</a>
+  check="all" check_existence="none_exist" comment="Check user ids on
all files on the system"
+  id="no_files_unowned_by_user_test" version="1"&gt;
+    &lt;unix:object object_ref="file_permissions_unowned_object" /&gt;
+  &lt;/unix:file_test&gt;
 &lt;/def-group&gt;
+  
<div class="moz-txt-sig">-- 
1.7.1

</div></pre>
      </div>
    </blockquote>
    Works on my machine. Ack.<br>
    <br>
    <br>
  </body>
</html>