<def-group>
  <definition class="compliance" id="file_permissions_unauthorized_sgid" version="1">
    <metadata>
      <title>Find setgid files system packages</title>
      <affected family="unix">
        <platform>Red Hat Enterprise Linux 6</platform>
      </affected>
      <description>All files with setgid should be owned by a base system package</description>
      <reference source="JL" ref_id="RHEL6_20150703" ref_url="test_attestation"/>
    </metadata>
    <criteria>
      <criterion comment="Check all setgid files" test_ref="check_setgid_files" />
    </criteria>
  </definition>

  <unix:file_test check="all" check_existence="none_exist" comment="setgid files outside system RPMs" id="check_setgid_files" version="1">
    <unix:object object_ref="object_file_permissions_unauthorized_sgid" />
  </unix:file_test>

  <unix:file_object comment="files with sgid set" id="object_file_permissions_unauthorized_sgid" version="1">
    <unix:behaviors recurse="directories" recurse_direction="down" max_depth="-1" recurse_file_system="local" />
    <unix:path operation="equals">/</unix:path>
    <unix:filename operation="pattern match">^.*$</unix:filename>
    <filter action="include">state_file_permissions_unauthorized_sgid</filter>
    <filter action="exclude">state_sgid_whitelist</filter>
  </unix:file_object>

  <unix:file_state id="state_file_permissions_unauthorized_sgid" version="1">
    <unix:sgid datatype="boolean">true</unix:sgid>
  </unix:file_state>

  <!-- list of all setgid files included with base RHEL6 system -->
  <unix:file_state id="state_sgid_whitelist" version="1">
    <unix:filepath var_ref="var_sgid_whitelist" var_check="at least one" />
  </unix:file_state>

  <constant_variable id="var_sgid_whitelist" version="1" datatype="string" comment="sgid whitelist">
    <value>/bin/cgclassify</value>
    <value>/bin/cgexec</value>
    <value>/sbin/netreport</value>
    <value>/usr/bin/crontab</value>
    <value>/usr/bin/gnomine</value>
    <value>/usr/bin/iagno</value>
    <value>/usr/bin/locate</value>
    <value>/usr/bin/lockfile</value>
    <value>/usr/bin/same-gnome</value>
    <value>/usr/bin/screen</value>
    <value>/usr/bin/ssh-agent</value>
    <value>/usr/bin/wall</value>
    <value>/usr/bin/write</value>
    <value>/usr/lib64/vte/gnome-pty-helper</value>
    <value>/usr/libexec/kde4/kdesud</value>
    <value>/usr/libexec/utempter/utempter</value>
    <value>/usr/lib/mailman/cgi-bin/admindb</value>
    <value>/usr/lib/mailman/cgi-bin/admin</value>
    <value>/usr/lib/mailman/cgi-bin/confirm</value>
    <value>/usr/lib/mailman/cgi-bin/create</value>
    <value>/usr/lib/mailman/cgi-bin/edithtml</value>
    <value>/usr/lib/mailman/cgi-bin/listinfo</value>
    <value>/usr/lib/mailman/cgi-bin/options</value>
    <value>/usr/lib/mailman/cgi-bin/private</value>
    <value>/usr/lib/mailman/cgi-bin/rmlist</value>
    <value>/usr/lib/mailman/cgi-bin/roster</value>
    <value>/usr/lib/mailman/cgi-bin/subscribe</value>
    <value>/usr/lib/mailman/mail/mailman</value>
    <value>/usr/lib/vte/gnome-pty-helper</value>
    <value>/usr/sbin/lockdev</value>
    <value>/usr/sbin/postdrop</value>
    <value>/usr/sbin/postqueue</value>
    <value>/usr/sbin/sendmail.sendmail</value>
  </constant_variable>

</def-group>
