Description of problem:
Based on discussion https://bugzilla.redhat.com/show_bug.cgi?id=1693026 which is about rule file_permissions_unauthorized_suid we have designed a solution which needs update of OpenSCAP rpmverifyfileprobe.

The probe doesn't handle path returned by rpmdb if the path isn't canonical, eg. contains symlinks.

I have found that this rpmverifyfile_object does not match anything:

    <lin-def:rpmverifyfile_object id="oval:x:obj:3" version="1" comment="all files with suid set that come from a RPM package">
      <lin-def:behaviors nolinkto="true" nomd5="true" nosize="true" nouser="true" nogroup="true" nomtime="true" nomode="true" nordev="true" nofiledigest="true" nocaps="true" />
      <lin-def:name operation="pattern match">.*</lin-def:name>
      <lin-def:epoch operation="pattern match">.*</lin-def:epoch>
      <lin-def:version operation="pattern match">.*</lin-def:version>
      <lin-def:release operation="pattern match">.*</lin-def:release>
      <lin-def:arch operation="pattern match">.*</lin-def:arch>
      <lin-def:filepath>/usr/sbin/mount.nfs</lin-def:filepath>
    </lin-def:rpmverifyfile_object>

OTOH the similar object but with /sbin/mount.nfs matches the nfs-utils package.

But rpm -qf can find the nfs-utils package for both paths.

Version-Release number of selected component (if applicable):
1.2.17-2.el7

How reproducible:
always

Steps to Reproduce:
1. evaluate rules file_permissions_unauthorized_suid and file_permissions_unauthorized_sgid proposed in https://github.com/ComplianceAsCode/content/pull/4648
2.
3.

Actual results:
Probe reports false positives such as "/sbin/mount.nfs is not owned by any RPM" when the OVAL content from https://github.com/ComplianceAsCode/content/pull/4648 is evaluated.

Expected results:
Probe handles paths than contain symlinks and doesn't report files that are owned by RPM package as files that aren't owned by any RPM.


Additional info:
The fix has been proposed upstream in https://github.com/OpenSCAP/openscap/pull/1412