exclude proc/selinux files from world_writeable_files

The following commit in openscap causes proc to be considered a 'local'
filesystem.
---
commit a9d98d697d85cb7f26c615543276e042c9749af0
Author: Tomas Heinrich <theinric@redhat.com>
Date:   Tue Nov 12 11:01:21 2013 +0100

    OVAL: change the algo used to distinguish 'local' and 'remote' fs

    With 'local', fts now descends into /proc and /sys, among others,
    which were previously excluded. This can cause performance issues.
---

The 'world_writeable_files' test will fail if a world-writeable
regular file is found. So we must mask out /proc files with a filter.
I did a `find / -perm -002 -type f` and also found some 'special' files
in /selinux that are world-writeable and type f, so a filter has been
added for those too.
exclude /sys from search in world_writeable_files
additional sshd timeout values
specified sshd timeout value
Merge branch 'master' of git://git.fedorahosted.org/git/scap-security-guide
[RHEL/6, RHEL/7, shared] Fix "Invalid OVAL definition referenced by XCCDF Rule: install_vsftpd" utils/verify-references.py issue
[RHEL/6] Fix "Invalid OVAL definition referenced by XCCDF Rule: root_path_no_dot" ../utils/verify-references.py warning message
[RHEL/6] Fix couple of XML syntax errors in files:
* src/input/profiles/nist-CL-IL-AL.xml
* RHEL/6/input/auxiliary/nist_support.xml

as reported by verify-input-sanity.py script (the other two files currently reported too are red herrings)
Merge branch 'master' of git://git.fedorahosted.org/git/scap-security-guide
As identified by Carlos M., the gconf_gnome_screensaver_idle_delay check needed updating per
Red Hat bug 867945<https://bugzilla.redhat.com/show_bug.cgi?id=867945>

Testing for <= conditions:

[shawnw@ssg-rhel6-devbox checks]$ sudo gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type int --set /desktop/gnome/session/idle_delay 15
[shawnw@ssg-rhel6-devbox checks]$ gconftool-2 -g /desktop/gnome/session/idle_delay
15
[shawnw@ssg-rhel6-devbox checks]$ ./testcheck.py gconf_gnome_screensaver_idle_delay.xml
external_variable with id : inactivity_timeout_value
Evaluating with OVAL tempfile : /tmp/gconf_gnome_screensaver_idle_delay9I6ODL.xml
Writing results to : /tmp/gconf_gnome_screensaver_idle_delay9I6ODL.xml-results
Definition oval:scap-security-guide.testing:def:199: true
Definition oval:scap-security-guide.testing:def:198: true

[shawnw@ssg-rhel6-devbox checks]$ sudo gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type int --set /desktop/gnome/session/idle_delay 10
[shawnw@ssg-rhel6-devbox checks]$ ./testcheck.py gconf_gnome_screensaver_idle_delay.xml
external_variable with id : inactivity_timeout_value
Evaluating with OVAL tempfile : /tmp/gconf_gnome_screensaver_idle_delayMU0FZv.xml
Writing results to : /tmp/gconf_gnome_screensaver_idle_delayMU0FZv.xml-results
Definition oval:scap-security-guide.testing:def:199: true
Definition oval:scap-security-guide.testing:def:198: true
Evaluation done.

Testing for > conditions:
[shawnw@ssg-rhel6-devbox checks]$ sudo gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type int --set /desktop/gnome/session/idle_delay 100
[shawnw@ssg-rhel6-devbox checks]$ ./testcheck.py gconf_gnome_screensaver_idle_delay.xml
external_variable with id : inactivity_timeout_value
Evaluating with OVAL tempfile : /tmp/gconf_gnome_screensaver_idle_delayfWk9E5.xml
Writing results to : /tmp/gconf_gnome_screensaver_idle_delayfWk9E5.xml-results
Definition oval:scap-security-guide.testing:def:199: true
Definition oval:scap-security-guide.testing:def:198: false
Evaluation done.
Added vim swap files to checks/.gitignore
As identified by DISA FSO, the OCIL text did not check all locations as OVAL.
XCCDF rule name audit_file_access --> audit_rules_unsuccessful_file_modification
OVAL was checking for /bin/ping, not all SUID commands, and giving false positives. Disabling OVAL until fix developed.
Tracking via https://github.com/OpenSCAP/scap-security-guide/issues/5
Naming mismatch, deny_password_attempts_unlock_time --> accounts_passwords_pam_faillock_unlock_time

[shawnw@ssg-rhel6-devbox checks]$ grep -rin deny_password_attempts_unlock ../
../system/accounts/pam.xml:442:<Rule id="deny_password_attempts_unlock_time" severity="medium">
../auxiliary/stig_overlay.xml:1003:	<overlay owner="disastig" ruleid="deny_password_attempts_unlock_time" ownerid="RHEL-06-000356" disa="47" severity="medium">
../profiles/nist-CL-IL-AL.xml:175:<select idref="deny_password_attempts_unlock_time" selected="true" \>
../profiles/stig-rhel6-server-upstream.xml:96:<select idref="deny_password_attempts_unlock_time" selected="true" />
../profiles/CSCF-RHEL6-MLS.xml:65:<select idref="deny_password_attempts_unlock_time" selected="true" />
../profiles/fisma-medium-rhel6-server.xml:89:<select idref="deny_password_attempts_unlock_time" selected="true" />
[shawnw@ssg-rhel6-devbox checks]$ sed -i 's/deny_password_attempts_unlock_time/accounts_passwords_pam_faillock_unlock_time/g' ../system/accounts/pam.xml ../auxiliary/* ../profiles/*
[shawnw@ssg-rhel6-devbox checks]$ grep -rin deny_password_attempts_unlock ../
Updated OVAL name, logrotate_rotate_all_files -> ensure_logrotate_activated

[shawnw@ssg-rhel6-devbox checks]$ grep -rin logrotate_rotate_all_files ../
../system/logging.xml:377:<oval id="logrotate_rotate_all_files" />
../checks/testids.ini:48:logrotate_rotate_all_files = 196
../checks/logrotate_rotate_all_files.xml:3:  id="logrotate_rotate_all_files" version="1">
Binary file ../checks/.logrotate_rotate_all_files.xml.swp matches
[shawnw@ssg-rhel6-devbox checks]$ sed -i 's/logrotate_rotate_all_files/ensure_logrotate_activated/g' ../system/logging.xml logrotate_rotate_all_files.xml
[shawnw@ssg-rhel6-devbox checks]$ git mv logrotate_rotate_all_files.xml ensure_logrotate_activated.xml
[bugfix] no_files_unowned_by_user, 'symlinks and directories' -> 'directories'

Per discussions on the list, there's really no need to use 'symlinks and directories' here.