Description of problem:

The rule set under OpenSCAP profile 'xccdf_org.ssgproject.content_profile_pci-dss' below is checking group_id with 4 instead of 0 (root). So the rule is failing even if group_id is set as expected.

<ns4:file_state id="oval:ssg-state_rsyslog_files_groupownership:ste:1" version="1">
          <ns4:type operation="equals">regular</ns4:type>
          <ns4:group_id datatype="int">4</ns4:group_id>      <<< ### 4 and not 0
        </ns4:file_state>
        <ns4:file_state id="oval:ssg-state_rsyslog_files_ownership:ste:1" version="1">
          <ns4:type operation="equals">regular</ns4:type>
          <ns4:user_id datatype="int">0</ns4:user_id>

Version-Release number of selected component (if applicable):
openscap-1.2.10-3.el7_3.x86_64

How reproducible:
Run the report to check group ownership on all rsyslog log files as follows.


Steps to Reproduce:
1. Install scap-security-guide package
2. Set owner and group as root.root for all rsyslog log files
3. Run rule to check group ownership of root files

Actual results:
Rule fails, as it expects group_id to be 4 instead of 0.

Expected results:
Rule should pass, as group is set as root for all the files. The rule should check group_id to be '0' and not '4'.

Additional info: