Description of problem:

The SSG NIST policy has a rule ("xccdf_org.ssgproject.content_rule_rpm_verify_permissions") whose identifier is CCE_27209-6. 
This rule runs rpm -Va and fails if any files are marked with a capital letter M in the second field of the output, which indicates the file's filesystem permissions differ from what the RPM database believes they should be. 

One such file is /boot/efi/EFI/redhat which is owned by the grub2-pc package. 

/boot/efi is the EFI partition, which needs, in order to comply with the EFI standard, to be FAT. No POSIX filesystem permissions can be stored on it. 

As such, RPM packages should not deploy files to this filesystem, as any files RPM packages stored on such a filesystem will get registered in the RPM database, and subsequently fail SCAP policies (such as, in our case, but not limited to, NIST-171). 

I am unsure if there is a %files directive that excludes files from being registered in the RPM database (of the %doc, %config etc variety). 
If there is such a directive, it should be used for the above. If not, then files intended for the EFI filesystem should be deployed by the RPM %files spec section onto some other POSIX permissions capable filesystem (/tmp, /var, pick your poison), and copied over by the RPM %post, thus avoiding the SCAP pitfall, 

Note this is the only file on a @base install on a UEFI system that thus flags and fails a red (Severity: High) benchmark test.


Version-Release number of selected component (if applicable):
7.5

How reproducible:
100%

Steps to Reproduce:
1. Install RHEL 7.5 on a UEFI system (for example, HyperV "gen2"(e.g. UEFI) VM, or any mac)
2. Remediate any files whose filesystem perms are not consistent with RPM database perms by running:
for file in `rpm -Va|grep '^.M|cut -c14-`; do rpm -qf $file; done|xargs rpm --setperms
3.run the SCAP security benchmark:
rpm -Va|grep '^.M

Actual results:
Output of step 3 above will be:
.M....... /boot/efi/EFI/redhat

Expected results:
Output of the above to be empty.

Additional info:
As above.