OpenSCAP/scap-security-guide — pull request #327 by iankko (2014-11-05 17:25:32+00:00)
Title: [bugfix] [RHEL/6]  Whitelist /bin/cgclassify executable coming from libcgroup RPM to fix no_unpackaged_sgid_files false positive

As can be seen in scan report coming from RHEL-6.6 x86_64 server:
[1] https://jlieskov.fedorapeople.org/no_unpackaged_sgid_suid_files_report.html

the OVAL check for ```Ensure All SGID Executables Are Authorized``` returns failure (together with listing the following entry:
```
setgid files outside system RPMs
path type UID	GID size permissions
/bin/cgclassify	regular	0	496	11984	rwxr-sr-x
```
) as the one not meeting the requirement.

But further investigation of the RHEL-6's system situation / conditions returns:
```
[root@localhost ~]# cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.6 (Santiago)
[root@localhost ~]# uname -i
x86_64
[root@localhost ~]# rpm -qf /bin/cgclassify
libcgroup-0.40.rc1-12.el6.x86_64
```
IOW the reported result is false positive, since as can be seen above, ```/bin/cgclassify``` isn't unauthorized / arbitrary SGID executable, but rather comes from ```libcgroup-0.40.rc1-12.el6.x86_64``` RPM package.

Thus fix this false positive case by whitelisting /bin/cgclassify executable in corresponding OVAL check's variable. Also, modify the indentation of that OVAL check, so it would be better readable (IOW child elements to be shifted by common 2 spaces, rather than shifted by random / varying count of spaces across different OVAL objects).

Testing report:
--
Proposed PR has been tested on RHEL-6 system & works as expected (no false positive reported after the change).

Please review.

Thank you, Jan.