[BugFix] [RHEL/6, RHEL/7, Fedora] Fix & simplify accounts_root_path_dirs_no_write OVAL check. Make it shared.

[iankko]

The current version of accounts_root_path_dirs_no_write OVAL check:
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/checks/accounts_root_path_dirs_no_write.xml

creates / generates a false-positive on a completely safe RHEL-6 system (when none of root's path directories has group or other write permission). The problem is use of any_exist check_existence clause:

• at https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/checks/accounts_root_path_dirs_no_write.xml#L29 and
• at https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/checks/accounts_root_path_dirs_no_write.xml#L44

Use of any_exist clause will return true for 0, 1, or more objects of such feature being present on the system. Since tests result is subsequently OR-ed, and negated at the end yet:
https://github.com/OpenSCAP/scap-security-guide/blob/master/RHEL/6/input/checks/accounts_root_path_dirs_no_write.xml#L13

this means that this check will everytime return fail as a result.

Example #1 - consider completely safe system (none of root's path directories has write permission set for group or other) =>

• test_accounts_root_path_dirs_no_write_group will return true (since zero such objects are present)
• test_accounts_root_path_dirs_no_write_other will return also true (since due to any_exist again zero objects would meet the success)

OR-in true and true gives true again. And finally negating true returns false (the check will return failure on completely safe system).

Besides that:

• that check is overly complex (two tests OR-ed & negated at the end are used where just one test could be enough) => this PR simplifies the implementation (OR-s the permissions state & requires none such object to exist on the system),
• is RHEL-6 specific => this PR makes it to be shared & usable from RHEL/7 & Fedora too.

Testing report:

The proposed change has been tested on all three of RHEL/6, RHEL/7 & Fedora & works fine (returns pass, when pass is expected, returns failure when some of the directories has write permissions either for group or other [or both]).

Please review.

Thanks, Jan.

[redhatrises]

LGTM. Ack. Thanks!

[iankko]

Thank you.